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SPECIFICATION 



TO ALL WHOM IT MAY CONCERN: 

BE IT KNOWN that we KUNIO KOBAYASHI, a subject of Japan 
and residing at Shinjuku-ku, Tokyo, Japan, FflKARU MORITA a subject of Japan 
and residing at Shinjuku-ku, Tokyo, Japan and KOUTAROU SUZUKI a subject of 
Japan and residing at Shinjuku-ku, Tokyo, Japan have invented certain new and 
useful improvements in 

"SYSTEM AND METHOD FOR QUANTITATIVE COMPETITION AND 
RECORDING MEDIUM HAVING RECORDED THEREON PROGRAM FOR 
IMPLEMENTING THEM" 

and we do hereby declare that the following is a full, clear and exact description of 
the same; reference being had to the accompanying drawings and the numerals of 
reference marked thereon, which form a part of this specification. 
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SYSTEM AND METHOD FOR QUANTITATIVE COMPETITION AND 
RECORDING MEDIUM HAVING RECORDED THEREON PROGRAM 
FOR IMPLEMENTING THEM 

5 BACKGROUND OF THE INVENTION 

The present invention relates to a quantitative competition system and 
method which compare aimed or intended values of participants and publish 
the highest or lowest value but hide the other values, and a recording medium 
on which there is recorded a program for implementing the method. More 

10 particularly, the invention pertains to a system and method for quantitative 
comparison of secret values, for example, in electronic lottery, electronic 
voting, or electronic sealed-bid auction under circumstances where many 
participants are allowed to access the server online across the Internet. 

Fig. 1 is depicts in block form the configuration of a conventional 

15 electronic competitive bidding or sealed-bid auction system. A notice of 
auction is input to bidding devices 10 { to 10 M , which send their identifiers ID! 
to ID M and bidding prices PR L to PR M to a bid-opening device 20. In this 
transfer of each data, if it is desirable to keep the data secret, the bidding price 
is sent in compressed form, and if it is necessary to identify the data, it is sent 

20 together with a digital signature of the bidder. The bid-opening device 20 
detects the highest (or lowest) one of the bid values received from the bidding 
devices 10 { to 10 M , and outputs the winning bid and the identifier 
corresponding thereto. This scheme is disclosed, for example, in Japanese 
Patent Application Laid-Open Gazette No. 118876/90 entitled "Electronic 

25 Bidding System." On the other hand, schemes which publish only the 
winning bid but hide other information involved are disclosed, for example, in 
Kazuo SAKO, "Auction Protocol Which Hides Bids of Losers," The 
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Symposium on Cryptography and Information Security, SCIS'99, and in 
Shingo MIYAZAKI and Kouichi SAKURAI, "A Bulletin-Board Base Digital 
Auction Scheme with Bidding Down Strategy," The Symposium on 
Cryptography and Information Security SCIS'99. 
5 The sealed-bid auction scheme to which the present invention is 

applied satisfies the requirements mentioned below. 

*Only bidding prices are used to determine the winning bid; that is, 
the successful bidding device is not determined using other information. 

* The bid-opening device and a provisional identifier registration 
10 device neither cheat nor malfunction. 

SUMMARY OF THE INVENTION 

It is therefore an object of the present invention to provide a 
quantitative competition system and method which ensure the fairness of a 
1 5 sealed-bid auction, the validity of a successful bid value, the undeniability of 
bidders, the anonymity of the bidders and the freedom from double bidding. 

The fairness of an auction means that it is possible to prevent bidders 
from obtaining information on other bidding devices prior to bidding in an 
attempt to make bids with unfair advantage. 
20 The validity of a successful bid value means that it is possible to 

prevent an unfair determination of the winning bid. 

The undeniability of bidders means that it is possible to prevent them 
from denying their bid values at the bid-opening time. 

The anonymity of bidders means that it is possible to prevent leakage 
25 of identification information of every bidding device. 

According to the present invention, each bidding device transforms its 
bidding price to bidding price information through utilization of a one-way 
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function, and the bid-opening device uses the bidding price information to 
determine the successful bid without revealing the prices bid by unsuccessful 
bidders. 

5 BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram showing the general configuration of an 
electronic competitive bidding system; 

Fig. 2 is a flowchart showing the general procedure of an electronic 
sealed-bid auction; 

10 Fig. 3 is a block diagram depicting a bidding device which uses one- 

way functions to generate a bid index; 

Fig. 4 is a block diagram depicting a concrete example of a bidding 
price transformer using one-way function processors; 

Fig. 5 is a flowchart showing the procedure for generating the bid 
1 5 index through the use of one-way functions; 

Fig. 6 is a block diagram illustrating the functional configuration of a 
bid-opening device 20 in a first embodiment of the present invention which is 
designed to determine the highest price bid as the winning bid; 

Fig. 7 is a flowchart showing the operation of the bid-opening device 
20 20 depicted in Fig. 6; 

Fig. 8 is a block diagram illustrating the functional configuration of a 
bid-opening device in a second embodiment of the present invention; 

Fig. 9 is a flowchart showing the operation of the bid-opening device 
depicted in Fig. 8; 

25 Fig. 10 is a block diagram illustrating the functional configuration of a 

bid-opening device in a third embodiment of the present invention which is 
designed to determine the highest price bid as the winning bid; 
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Fig. 11 is a flowchart showing the bid-opening procedure of the bid- 
opening device depicted in Fig. 10; 

Fig. 12 is a block diagram illustrating the functional configuration of a 
bidding device in a fourth embodiment of the present invention; 
5 Fig. 13 is a block diagram illustrating the functional configuration of a 

bid-opening device in the fourth embodiment; 

Fig. 14 is a flowchart showing the bid-opening procedure of the bid- 
opening device depicted in Fig. 13; 

Fig. 15 is a block diagram illustrating the functional configuration of a 
1 0 bidding device in a fifth embodiment of the present invention; 

Fig. 16 is a flowchart showing the bidding procedure of the bidding 
device depicted in Fig. 15; 

Fig. 17 is a block diagram illustrating the functional configuration of a 
bid-opening device in a fifth embodiment of the present invention; 
15 Fig. 18 is a flowchart showing the bid-opening procedure of the bid- 

opening device depicted in Fig. 17; 

Fig. 19 is a flowchart showing the bid-opening procedure in a 
modified form of the fifth embodiment; 

Fig. 20 is a block diagram illustrating the functional configuration of a 
20 bidding device in a sixth embodiment of the present invention; 

Fig. 21 is a flowchart showing the bidding procedure of the bidding 
device depicted in Fig. 20; 

Fig. 22 is a block diagram illustrating the functional configuration of a 
bid-opening device in the sixth embodiment; 
25 Fig. 23 is a flowchart showing the bid-opening procedure of the bid- 

opening device depicted in Fig. 22; 

Fig. 24 is a flowchart showing a modified form of the bid-opening 
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procedure depicted in Fig. 23; 

Fig. 25 is a block diagram illustrating the functional configuration of a 
bidding device in a seventh embodiment of the present invention; 

Fig. 26 is a flowchart showing the bidding procedure of the bidding 
5 device depicted in Fig. 25; 

Fig. 27 is a block diagram illustrating the functional configuration of a 
bid-opening device in the seventh embodiment; 

Fig. 28 is a flowchart showing the bid-opening procedure of the bid- 
opening device depicted in Fig. 27; 
10 Fig. 29 is a flowchart showing a modified form of the bid-opening 

procedure depicted in Fig. 28; 

Fig. 30 is a block diagram illustrating the functional configuration of a 
bidding device in an eighth embodiment of the present invention; 

Fig. 3 1 is a block diagram illustrating the functional configuration of a 
15 bidOopening device in the eighth embodiment; 

Fig. 32 is a flowchart showing the bid-opening procedure of the bid- 
opening device depicted in Fig. 3 1 ; 

Fig. 33 is a block diagram illustrating an electronic sealed-bit auction 
system which utilizes a provisional identifier; and 
20 Fig. 34 is a flowchart showing the bidding procedure in the system 

depicted in Fig. 33. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
First Embodiment 

25 The electronic competitive sealed-bid auction system according to this 

embodiment comprises, as is the case with Fig. 1, M bidding devices 10j to 
10 M and a bid-opening device 21, which are accessible to each other. This 
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system operates as depicted in the flowchart of Fig. 2. 

Step SI: Input a notice of auction to each of the bidding devices I0 l to 
10 M . The notice of auction describes bidding conditions such as the name of 
an object for auction, the highest and/or lowest price bid, the term for bidding 
5 and qualifications for bidding, and a method of access to the bid-opening 
device. The bidding conditions differ with objects for auction. 

Step S2: In response to the notice of auction which describes the 
details of the auction, each bidding device 10 m (where m = 1, 2, M) 
generates a bidding price, and sends to the bid-opening device 20 the bidding 
10 price PR^ and an identifier ID m by which the bidding device 10 m can be 
identified. 

Step S3: Having received from the respective bidding device I0 l to 
10 M their bidding prices PR! to PR M and identifiers ID! to ID M , the bid- 
opening device 20 computes the highest (or lowest) one of the bidding prices 
15 and determines it to be the winriing bid. 

Step S4: The bid-opening device 20 outputs the winning bid and the 
identifier of the bidding device having submitted it. 

The above procedure is the same as in the prior art. Since the 
communication channel between each bidding device 10 m and the bid-opening 
20 device 20 is not an anonymous channel, in particular, such a procedure as 
shown in Fig. 2 allows each bidding device 10 m to learn the bidding prices of 
the other bidding devices by wiretapping. To avoid this, according to the 
present invention, each bidding device 10m uses one-way functions to 
transform the bidding price to bidding price information, which is sent to the 
25 bid-opening device 20. 

Referring to Fig. 3, the bidding device 10m comprises an input part 11, 
an information storage part 12, a control part 13 and a bidding price 
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transformer 14. The control part 13 follows a control procedure stored in the 
information storage part 12 to control operations of the respective parts. The 
notice of auction, which describes the bidding conditions, is provided in 
advance via a channel to the bidding device 10 m from the bid-opening device 
5 20 or some other device. In the information storage part 12 there are also 
stored the identifier ID m of this bidding device 10m and an initial value IV m 
which is used for bidding. At the time of bidding, the bidding price PR^ 
provided to the input part 11 is fed via the control part 13 into the bidding 
price transformer 14. The bidding price transformer 14 uses one-way 

10 functions to transform the bidding price PR^ to bidding price information j m 
in integral form. The bidding price information y m and the identifier ID m are 
sent from a transceiver (not shown) to the bid-opening device 20 via a 
commimication channel. Based on the bidding price information from every 
bidding device 10 m , the bid-opening device 20 decides the wmning bid. 

15 In this embodiment, the bidding price transformer 14 is supplied with 

the initial value IV m read out of the information storage part 12 by the control 
part 13 and the bidding price PR m , and processes the initial value IV m by a 
one-way function by the number of times corresponding to the bidding price 
PR^ as described below. A one-way function is such a function that, given a 

20 variable x, y(=h(x)) can easily be computed from x, but when given y, very 
high computational complexity is needed to compute x such that y=h(x). An 
output value, obtained by processing the initial value IV m with the one-way 
function h by k times like h(. . .h^h^VJ)). . .), will hereinafter be represented 
by h k (IV m ). 

25 A concrete example of the bidding price transformer 14 is depicted in 

Fig. 4 and its procedure in Fig. 5. The bidding price transformer 14 
comprises a data storage part 14S, conversion table memory 15, a one-way 
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function h processor 16 and a one-way function g processor 17. Incidentally, 
the examples of the bidding device 10 m depicted in Figs. 3 and 4 will also be 
referred to in describing second and third embodiments of the invention later 
on, in which case the broken-lined data storage part 14S is provided to store 
5 the result D m of each computation by the one-way function h and the final 
result C m of computation. A conversion table, which is stored in the 
conversion table memory 15, is contained as one bidding condition in the 
notice of auction, for instance. Each bidding device 10m reads out the 
conversion table from a bulletin board 25 of the bid-opening device 20 which 

10 will be described later on with reference to Fig. 6. The conversion table is a 
table on which there are shown appropriately-separated K bidding prices from 
the lowest to the highest bidding price and a series of corresponding indexes k 
= 1, 2, K. Each bidding device 10 m selects a desired bidding price from 
the conversion table and uses the corresponding index k as a bidding price 

15 index k^ In the Fig. 4 example the bidding prices corresponding to the 
indexes k = 1, 2, K are arranged to monotonously increase, but by 
arranging them to monotonously decrease, the lowest bidding price can be 
made a winning bid. 

The one-function h processor is supplied with the initial value IV m and 

20 the price index corresponding to the bidding price PR^ read out of the 
conversion table memory 15, and repeatedly processes the initial value IV m 
with the one-way function h by the number of times corresponding to the 
price index k^. As a result, h^IVJ is obtained. The one-way function g 
processor 17 further processes the output value h km (IV m ) with a one-way 

25 function g to compute y m = g(h km (IV m )), and output it as bidding price 
information. 

Step SI : Input the bidding price PP^ and the initial value IV m . 
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Step S2: Read out of the conversion table memory 15 the price index 
k,^ corresponding to the bidding price PR m . 

Step S3: In the one-way function h processor 16, set the initial value 
of a variable t at 0 and the initial value IV m as y m , and repeat steps S4 and S5. 
5 Step S4: Determine if t is smaller than k m . 

Step S5 : If t < k m , update y m with the value of h(y m ) at that time, then 
increment t by one, and return to step S4. 

Step S6: When t becomes no longer smaller than k^, y m = h km (IV m ), 
which is processed by the one-way function g processor 17 such that y m <— 
10 g(yj. 

Step S7: Output, as the bidding price information, y m obtained in step 

S6. 

B ID-Opening Device (Successful Bid: Highest Bidding Price Bid) 

Fig. 6 is a block diagram of the bid-opening device 20, which 

15 comprises a control unit 21, and a one-way function h processor 22, a one- 
way function g processor 23, an adder/subtractor 24, a bulletin board 25, a 
program storage part 27S, an information storage part 35 and an update data 
storage part 36 which are all connected to the control unit 21. In the 
program storage part 27S there is stored a bid-opening procedure as a 

20 program, and the control unit 21 follows the program to control operations of 
the respective parts. The one-way function h processor 22 and the one-way 
function g processor 23 are series-connected. The parts except the bulletin 
board 25 constitute a winning bid selector 27. The number of bidding 
devices are M, and the initial value IV m unique to each bidding device 10 m 

25 (where m = 1, 2, M) is prestored by some means in the information 
storage part 35. In the bulletin board 25 there are also recorded other 
bidding conditions including a conversion table 25 A; furthermore, 
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verification information and the results of auction to be published are written 
in the bulletin board 25. The pieces of information are accessible from any 
external devices as well as from the bidding devices. In this case, however, 
assume that only the bid-opening device 20 is allowed to write in the bulletin 
5 board 25 (This applies to other embodiments). 

In Fig. 7 there is depicted the procedure of operation of the bid- 
opening device 20. In this example the bidding price corresponding to the 
largest price index is made a successful bid as follows. The index value 
is decremented one by one from the largest index K corresponding to the 

10 upper limit of the bidding price specified in the conversion table; a check is 
made for the presence of the bidding price information y m (where m = 1, 2, 
M) corresponding to each index k is present; and when the bidding price 
information y m corresponding to the index k is detected for the first time, the 
detected bidding price information y m is determined to be the winning bid, and 

15 m (the bidding device number) at that time is computed, with which the bid- 
opening procedure ends. 

Step SO: The bidding device 10 m inputs its bidding price information 
y m and identifier ID m (where m = 1, 2, . . . , M) to the bid-opening device 20. 

Step SI: The control unit 21 records the bidding price information y m 

20 and the identifier ID m in the bulletin board 25 accessible from arbitrary 
external devices (the bidding devices 10 { to 10 M and other devices which are 
not bidders). 

Step S2: To precalculate D ra (1) , D m (2) , D m (K) such that D m (k) =h(D m (k - 
L) ) in the subsequent steps S3 to S6, the control unit 21 sets the bidding price 
25 index k«-l, then reads out ID m from the information storage part 35, and 
substitutes it for D m (0) . 

Step S3: The control unit 21 determines whether k > K. 
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Step S4: If not k > K, process D m (k>1) by the one-way function h 
processor 22 to obtain D m (k) . 

Step S5: Store D m (k) in the update data storage part 36. 

Step S6: Increment k by the adder/subtractor 24 such that k<-k+l. 
5 Step S7: If k > K in step S3, it means that D m (1) =h(D m (0) )=h(IV m ), 

D m (2) =h(D m (1) )=h 2 (IV m ) D m (K) =h K (IVJ have all been obtained, then set k 
<-K. 

Step S8: Read out D m (K) =h K (IV m ) from the update data storage part 36 
and process it by the one-way function g processor 23 to obtain D m (k) 
10 <-g(D m (k) ). 

Step S9: For m = 1,2, . . ., M, the control unit 21 makes a check to see 
if there exists on the bulletin board 25 the bidding price information y m of the 
same value as D m (k) . 

Step S10: If there does not exist on the bulletin board 25 the 

15 information y m of the same value as D m (k) , the control unit 21 inputs k to the 
adder/subtractor 24 to decrement k by one (i.e., k<— k-1), then returns to step 
S8, and in steps S8 and S9 it makes a check to see if there exists on the 
bulletin board 25 the bidding price information y m of the same value as 
D m (k) =g(h k (IV m )) for m = 1 , 2, . . . , M. 

20 Step Sll: If the information y m of the same value as D m (k) is found on 

the bulletin board 25 in step S9, then the control unit 21 regards it as the 
successful price bid and outputs the index k at this time and the bidding 
device identifier ID m corresponding to the information y m , with which the 
procedure ends. 

25 As described above, a check is made first for a bidding device 10 m 

having input the bidding price information y m equal to D m (k) (=g(h k (IV m ))) 
when the price index k is at the upper limit value K; if no such a bidding 
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device is found, then a check is made for a bidding device 10 m having input 
the bidding price information y m equal to D m (k) when the index k is 
decremented by one, i.e. k-e-k-1; and if no such a bidding device is found, 
then a check is made for a bidding device 10 m having input the bidding price 
5 information y m equal to D m (k) when the index is further decremented by one, 
i.e. k<-k-l. By making a check, for each decremented value of k, for the 
bidding device 10 m having input the bidding price information y m equal to 
D m (k) (=g(h k (IV m ))), it is possible to find out the price information y m 
corresponding to the largest index k, that is, the highest bidding price PR m . 
10 Furthermore, each bidding device 10m sends h km+1 (IV m ) to the bid- 

opening device 20 in advance, and the bid-opening device 20 publishes it on 
the bulletin board 25 and, after determining the successful bidding price, 
publishes on the bulletin board 25 the highest bidding price index k and the 
identifier ID m of the successful bidding device and the verification 
15 information h k (IV m ); in this instance, since k ought to equal k^, it is possible 
for an arbitrary device, except the bid-opening device 20, to verify the validity 
or fairness of the bid-opening process by processing he published verification 
information h k (IV ra ) with the one-way function h to obtain h k+1 (IV m ) and 
making sure that it matches h km+1 (IV m ) published prior to the determination of 
20 the winning bid. Alternatively, the verification of the bid-opening procedure 
can be made by publishing the verification information h k (IV m ) of each 
bidding device on the bulletin board 25 in advance and making a check to see 
if the value, obtained by processing h^IVJ published on the bulletin board 
25 with the one-way function h by (K-k m ) times, matches h k (IV m ). 
25 In the case where the lowest price bid is the winning bid, the bidding 

prices corresponding to the price indexes k on the conversion table are 
arranged so that they monotonously increase from the lowest value, as 
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referred to previously. 

In the embodiment described above, all the bidding device 10! to 10 M 
send rr^^IVJ to the bid-opening device 20 in advance for verification of the 
results of bid-opening, and the bid-opening device 20 writes it on the bulletin 
5 board. It is easy to compute h k+1 (z) from h k (z) in the computation 
h k+1 (z)=h(h k (z)) using the one-way function, but the computation of h k (z) from 
h k+l (z) involves too enormous computational complexity to deal with 
practically. Accordingly, even if the bidding device publishes in advance 
h^CIVJ computed using an index k v larger than the bidding price index 
10 there is no possibility of other devices learning the index k m unless the bid- 
opening is performed in terms of the index k^. 

The value k v of the verification information h^IVJ may be a value 
k^l^+A which is obtained by adding the bidding price index 1^ with a 
predetermined integer A equal to or greater than 1, or a value k^K+A which 
15 is obtained by adding the maximum index K with the integer A. In the 
former case, rr^IVJ is processed A times with the one-way function h and 
the resulting value is checked for matching the published information h kv (IV m ). 
In the latter case, h^IVJ is processed K+A-l^ times with the one-way 
function h and the resulting value is checked for matching the published 
20 information h kv (IVJ. 

In the embodiment described above, the bidding devices 10 t to 10 M 
each convert the bidding price PR to the index k by the conversion table and 
the initial value IV m is processed with the one-way function by the number of 
times corresponding to the index k, but the use of the conversion table is not 
25 essential to the present invention. For example, the index k itself may be the 
bidding price, in which case neither of the bidding devices the bid-opening 
device requires the conversion table and any one of a series of value k which 
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monotonously increase one by one within a predetermined range defined by 
the upper and lower limits given as one of the conditions for auction is chosen 
as the bidding price PR. 

5 SECOND EMBODIMENT 

In the first embodiment the bid-opening device 20 must be informed 
of the initial value IV m of each bidding device 10 m . In this embodiment, 
however, the bid-opening device 20 requires the bidding device 10 m to send 
D m =h k (IV m ) corresponding to the price index k, and hence it does not need the 
10 initial value IV m . Since the price index k varies one by one such that k = 1, 2, 
K, this embodiment utilizes the fact that h k+1 (IV m ) = h(h k (IVJ) holds; the 
bid-opening device 20 verifies the response h k (IV m ) from the bidding device 
in reply to an inquiry k, then computes g(h k (IV m )), and checks it for matching 
the bidding price information y m (where m = 1, 2, . . . , M). 
15 A description will be given of the case where the highest bid is the 

successful bid. 

The bidding device 10 m has a configuration in which the data storage 
part 14S indicated by the broken line in Fig. 4 is added to the bidding price 
transformer 14. The bidding device 10 m precomputes D m = h k (IV m ) by the 

20 one-way function h processor 16 for each value k = 1, 2, K+l, and stores 
it in the data storage part 14S. When inquired about k from the bid-opening 
device 20, the bidding device 10 m reads out of the data storage part 14S the 
data h k (IV m ) corresponding to k and sends it as the response D m = h k (IV m ) to 
the bid-opening device 20. Furthermore, the bidding device 10 m sends to the 

25 bid-opening device 20 the data h K+1 (IV m ) as the verification information C m , 
together with the bidding price information y m . As depicted in Fig. 8, the 
bid-opening device 20 comprises a control unit 21, a one-way function h 
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processor 22, a one-way function g processor 23, a subtracter 24, a program 
storage part 27S and a bulletin board 25 accessible from other devices. On 
the bulletin board 25 there are published a conversion table 25A along with 
conditions for auction. 

The bid-opening device 20 operates as depicted in Fig. 9. 

The bidding devices 10 m each send h K+1 (TV m ) as the verification 
information C m in advance to the bid-opening device 20 together with the 
bidding price information y m and the identifier ID m . The bid-opening device 
20 publishes these pieces of data on the bulletin board 25. Let it be assumed 
here that M bids are submitted, and hence m = 1, 2, . . . , M. 

Step SI: Write and hence publish on the bulletin board 25 the plural 
pieces of data sent to the bid-opening device 20, that is, the bidding price 
information Y m (=g(h km (IV m ))), the verification information C m and the 
identifier ED m . 

Step S2: Set the initial value of the index k at the upper limit value K 
by control unit 21. 

Step S3: Request each bidding device 10 m to present D^h^IVJ. 
The bidding device 10 m reads out of the data storage part 14S the data h k (IV m ), 
and sends it to the bid-opening device 20 as D m . 

Step S4: Record and hence publish on the bulletin board 25 the data 
D m sent from every bidding device 10 m . 

Step S5: Generates h(D m ) for each D m by the one-way function h 
processor 22. 

Step S6: Make a check to see if all the pieces of data h(D m ) match all 
the pieces of verification information C m on the bulletin board 25; if no 
mismatch is found, then determine that they are all correct or valid, and 
continue the subsequent steps. If a mismatch is found, then sends an error 
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message to every bidding device 10 m and finish the bid-opening operation. 

Step S7: When no mismatch is found in step S6, generate data g(D m ) 
by the one-way function g processor 23 . 

Step S8: Make a check to see if each data g(DJ matches the bidding 
price information y m , if no match is found, update C m on the bulletin board 25 
with D m (C m <-D m ). 

Step S 10: Set k<-k-l by the subtractor 24 and return to step S3. 

Step Sll: If even one of the pieces of information y m is found to match 
with g(D m ) in step S8, decide k at that time as the price index corresponding 
to the winning bid, and output the index k and the identifier ID m of the 
bidding device 10 m having offered the successful bid. 

In this instance, the values of losing bids other than the winning one 
are kept secret from even the bid-opening device 20. 

In this embodiment, too, the lowest price bid can be chosen as the 
winning bid simply by arranging the bidding prices in such a manner as to 
monotonously decrease relative to a monotonously increasing index k on the 
conversion table, or by arranging the bidding prices in such a manner as to 
monotonously increase relative to a monotonously decreasing index k. 

THIRD EMBODIMENT 

In the second embodiment described above, as depicted in Fig. 9, the 
bid-opening device 20 requires all the bidding devices to present h k (IV m ) and 
receive it for each value of the price index k until the first detection of a 
match between g(DJ and y m in step S3. Accordingly, the sealed-bit auction 
scheme according to the second embodiment has the defect of a large 
communication cost. This embodiment requires the bid-opening device 20 
to be informed of nothing but the initial value IV m , publishes only the winning 
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bid, that is, hides the losing bids, and reduces the communication cost. 

The bidding device 10 m is identical in construction as in the second 
embodiment, and in the constructions of figs. 3 and 4 the data storage part 
14S is provided in which there are prestored D m (1) , D m (K) and C m = D m (k+1) . 

5 The bid-opening device 20, shown in Fig. 10, is basically identical in 
construction with the bid-opening device of Fig. 8, and no description will be 
repeated, but as will be described below with reference to Fig. 11, the 
operation of the bid-opening device in this embodiment differs from the 
operation depicted in Fig. 9. 

10 Step SO: The bidding devices 10, to 10 M each send in advance the 

verification information C m (= h k+1 (IV m )) to the bid-opening device 20 
together with the bidding price information y m ( =g(h km (IV m )) and the 
identifiers ID m . 

Step SI: The bid-opening device 20 first publishes the plural pieces of 
15 bidding price information y m and verification information C m and the 
identifiers ID m on the bulletin board 25. 

Step S2: Set the count value k of a counter 24 at the upper limit value 

K. 

Step S3: Inquire of all the bidding devices 10 m (where m = 1,2, 
20 M) about whether they have bid the price k. 

Step S4: Decide whether there is bidding device having bid with the 
price index k. 

Step S5: If no bidding device have bid the price, decrement k by the 
subtractor 24 to k<-k-l and return to step S3. 
25 Step S6: When it is found that any one of the bidding devices 10 m has 

bid with the price index k, request all the bidding devices 10m to present 
h k (IV m ). Each bidding device 10 m reads out of the data storage part 14S the 
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data D m = h k (IV m ) precalculated corresponding to k as depicted in Fig. 4, and 

sends the read-out data D m to the bid-opening device 20. 

Step S7: Publishes all the responses D m from the bidding devices 10 m 

on the bulletin board 25. 
5 Step S8: For all the responses D m , generate h K " k+1 (D m ) by the one-way 

function h processor 22. 

Step S9: Check whether each data h Kk+1 (D m ) matches the 

corresponding verification information C m on the bulletin board 25. If no 

mismatch is found, decide that the responses Dm are all correct, and proceed 
10 to the subsequent steps. If a mismatch is found, send an error message to 

each bidding device 10 m and finish this bid-opening session for the price 

index k. 

Step S10: When no mismatch is found in step S9, generate g(Dj) by 
the one-way function g processor 23 for the response Dj (where 1< j<M) from 
1 5 the bidding device 10j which has identified itself as having bid with the price 
k. 

Step Sll: Check whether g(D) matches the bidding price information 
Yj of the bidding device lOj on the bulletin board 25. If they match, decide 
that the bidding device 10j has bid the price k. If they do not match, send an 
20 error message to all the bidding devices and discontinue the session. 

As described above, in this embodiment, when no bidding device 
identifies itself as having bid the price k in reply to the inquiry in step S3, the 
bidding devices 10 m are not required to send D ra (= h k (IV m )) to the bid- 
opening device 20, and hence the communication cost is small as compared 
25 with that in the second embodiment accordingly. 

As described below, a check is made, if necessary, to see if another 
bidding device 10m (different from the device lOj) has bid a value higher than 
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k. 

Step S12: For t such that k<t<K and all m's except j (l<m<M, m*j), it 
is checked whether g(h t " k (h k (IV m ))) matches the bidding price information y m 
on the bulletin board 25 for t = k, k+1, K, and if a match is found, then 
send an error message to each bidding device concerned and discontinue the 
bid-opening session. 

Step SI 3: If no match is found, then output the winning bidding price 
k and the identifier IDj of the bidding device having offered the winning bid. 

With this check or verification, if a bidding device makes a false 
response to the inquiry about whether it has bid, for example, with k, this 
dishonest bidding device is detected; that is, this embodiment satisfies the 
"undeniability" requirement. When this checking does not takes place, the 
bid-opening device 20 outputs k and IDj when deciding in step Sll that the 
bidding device 10j has bid with k. 

In this way, this embodiment keeps losing bids, except the winning 
one, secret from even the bid-opening device 20 and reduces the 
communication cost. 

While in the above the highest price bid is the winning bid, the lowest 
price bid can be chosen as the successful bid simply by arranging 
monotonously decreasing (or increasing) values of the bidding price PR on 
the conversion table in a one-to-one correspondence with monotonously 
increasing (or decreasing) values of the price index k. 

FOURTH EM BODIMENT 

This embodiment is intended to permit simplification of the 
processing in the bid-opening device 20 and reduction of the communication 
cost. 
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As depicted in Fig. 12, each bidding device 10 m has a construction in 
which a random generator 18 and an operation part 19 are added to the 
bidding device shown in Figs. 3 and 4. The random generator 18 generates a 
random number known only to the bidding device 10 m . The operation 
part 19 uses the random number and the bidding price PP^ to perform a 
predetermined operation such as a bit concatenation, exclusive ORing, 
addition, or multiplication (which operation will hereinafter be denoted by 
(+)), then processes the operation result with the one-way function h, and 
sends the processed output h(PR m (+) R m ) to the bid-opening device 20, 
together with the bidding price information y m = g(h km (IV m )) and the identifier 
ID m . 

Fig. 13 illustrates in block form the functional configuration of the 
bid-opening device 20 in this embodiment, and Fig. 14 is a flowchart for 
explaining its operation. The bid-opening device 20 has a construction in 
which one-way function h processors 22' and 22" and an operation part 26 are 
added to the device of Fig. 10 and a subtractor 37 is replaced for the counter 
24. For simplicity sake, the program storage part 27 S is not shown. At the 
time of bidding every bidding device 10 m (where m = 1, 2, M) sends 
h K+1 (IVJ to the bid-opening device 20, along with the bidding price 
information y m (= g(h km (IV m ))), the identifier ID m and the random number 
information h(PR m (+) RJ. 

Step SI: Receive y m , C m (=h K+1 (IV m )), h(PR tn (+) RJ and ID m from each 
bidding device 20 and write and hence publish them on the bulletin board 25. 

Step S2: Request all the bidding devices 10 m to present their bidding 
prices PR,,, and random numbers R m . 

Step S3: Upon receiving PP^ and P^ from each bidding device 10m, 
compute (PR m (+)RJ in the operation part 26, then compute h(PR m (+)R m ) by 
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the one-way function h processor 22", and make a check to determine 
whether the value matches h(PR m (+)R m ) published on the bulletin board 25. 

Step S4: At this point the bid-opening device 20 learns all the bidding 
prices. The bid-opening device 20 obtains from the conversion table 25 A a 
5 price index k mx corresponding to the highest value among the bidding prices 
PR^. The bidding device (the successful bidding device) which has bid k^ 
will hereinafter be identified by 10j. At this point each bidding device 
cannot learn the bidding prices of the other bidding devices. 

Step S5: Send k mx to all the bidding devices 10 m and request them to 
1 0 present D m = h kmx (IV m ) . 

Step S6: Each bidding device 10m reads out D m - h kmx (IV m ) 
corresponding to k^ from the data storage part 14S described previously with 
respect to Fig. 4, and sends the read-out Dm to the bid-opening device 20, 
which writes on the bulletin board 25 all the pieces of data D m sent from the 
1 5 bidding devices 1 0 m . 

Step S7: For each Dm, calculates K+l-k mx by a subtractor 37 and 
generate h K+1 " kmx (D m ) by the one-way function h processor 22 from K+l-k^ 
and D m : 

Step S8: Verify whether h K+1 " kmx (D in ) matches the corresponding 
20 verification information C m on the bulletin board 25. If no mismatch is 
found, decides that all the responses Dm are correct, and proceed to the 
subsequent steps. If a mismatch is found, sends an error message to each 
bidding device and discontinue further operation. 

Step S9: If no mismatch is found in step S8, generate g(Dj) by the one- 
25 way function g processor 23 for Dj presented by the successful bidding device 
10 r 

Step S10: Verify whether g(D } ) matches the bidding price information 
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7j in the bidding data of the bidding device 20j on the bulletin board 25. If 
they match, decide that the bidding device 10j has bid with the price index k mx . 
If they do not match, send an error message to each bidding device and 
discontinue the current bid-opening session. 
5 As described below, a check is made, if necessary, to see if another 

bidding device 10m (different from the device lOj) has bid a value higher than 

Step Sll: For t = + 1, +2, K, compute h l - kmx (DJ by the 
one-way function processor 22' and process the computed result by the one- 

10 way function g processor 23 to obtain g^'^DJ), and verify whether this 
g(h t " kmx (D m )) matches the bidding price information y m on the bulletin board 
25 for all m's except j (l<m<M, m^j). 

Step S12: If a match is found, then send an error message to each 
bidding device concerned and discontinue the current bid-opening session. 

15 If no match found, then output the winning bidding price index k mx and the 
identifier DDj of the bidding device 10j having offered the winning bid. 

For example, in the case where the bidding device 10m bids with the 
random number information h(PR m (+)R m ) and the bidding price information 
y m = g(h km (IV m ) (where PR^PRJ and presents a price PR^' higher than the 

20 bidding price PR m and the random number R m in reply to the request for the 
presentation of PR m and R m in step S2 and the price PR m ' becomes the highest 
bid value, if the bidding device presents D m = h^XIVJ in reply to the request 
for the presentation of h kmx (IVJ in step S5, it will pass the verifications in 
steps S7 and S8, incurring the possibility that the price PR in lower than PR^ 

25 becomes the winning bid. However, this can be prevented because a 
mismatch is found between g(D m ) = gOi^IVJ) and y m = g(h km (IVJ in steps 
SlOandSll. 



With the bid-opening device 20, it is possible to specify the winning 
bid and the corresponding successful bidding device from PR^, R^ and ID m 
with ease, reduce the communication cost and verify that the winning bidding 
price and the winning device determined from PR^, R^ and ID m are true. 

5 

FTFTRKMROnTMRNTT 

In this embodiment each bidding device sends to the bid-opening 
device bidding price information containing select information which 
indicates whether to bid for each of K kinds of biddable prices. As depicted 
10 in Fig. 15, the bidding price transformer 14 of the bidding device 10m 
comprises a control part 41, a random generator 42, a one-way function h 
processor 43, a select information generator 45, a (+) operation part 46 and an 
adder 47. 

Let PR m represent that one of the K kinds of price indexes 1,2, K 
15 which the bidding device 10 m is to actually to bid. The select information 
denoted by b m (k) is defined as follows: b m (k) = 0 when the bidding device 10 m 
does not bid for the price index k such that l<k<K, and b m (k) = 1 when the 
bidding device 10 m bids for the price index k. Accordingly, only one piece 
of information b m (k) exists for k such that l<k<K. As mentioned above, the 
20 two values of the information b m (k) may be any values as long as they differ 
from each other. The information b m (k) is known only to the bidding device 
10 m , which uses it as a random number for each value of the price index k. 
The bidding device 10 m outputs (ID m , h(l(+)b m (1) (+)R m (1) ), h(2(+)b m (2) (+)R m (2) ), 
. . . , h(K(+)b m (K) (+)R m (K) } as bidding price information. 
25 A description will be given, with reference to Fig. 16, of the procedure 

by which K pieces of bidding price information are prepared. 

Step SI: The bidding price PR m is determined and input. 
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Step S2 : Set the initial value of the price index k to 1 . 
Step S3: Make a check to see if k<K. 

Step S4: If k<K, generate the random number R m (k) by the random 
generator 42. 

5 Step S5: Generate the rice select information b m (k) by the select 

information generator 45 in accordance with the bidding price PR^,. 

Step S6: The (+) operation part 46 inputs thereinto these pieces of 
information R m (k) and b m (k) , and compute k(+)b m {k) (+)R m (k) . (+) indicates a 
predetermined appropriate operation, which may be a concatenation, addition, 
10 subtraction, multiplication, or the like. 

Step S7: Process the result of this operation by the one-way function h 
processor 43 to generate h(k(+)b m (k) (+)R m (k) ). 

Step S8: Increment k by one by the adder 47, followed by a return to 
step S3. 

15 Step S9: When k exceeds K and the processing for all values of k ends, 

the bidding device 10 m sends the identifier ID m and the bidding price 
information {h(l(+)b m (1) (+)R m (1) ), h(K(+)b m (K) (+)R m < K >)} to the bid-opening 
device 20. 

By generating the bidding price information for each price through 
20 utilization of the one-way function and sending all the pieces of bidding price 
information to the bid-opening device 20 as described above, the aimed 
bidding price can be kept secret. 

Fig. 17 illustrates in block form the bid-opening device 20 which 
performs the bid-opening process based on such bidding price information 
25 sent thereto. The bid-opening device 20 comprises a control part 21, a one- 
way function h processor 22, a subtracter 24, an information storage part 35, a 
bulletin board 25 and a (+) operation part 51. As is the case with Fig. 8, the 
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program storage part 27 S is also provided but is not shown for the sake of 
brevity. 

Fig. 18 is a flowchart for explaining the operation of this bid-opening 
device 20. 

Step SO: Receive the bidding price information {ID m , 
h(l(+)b m (1) (+)R m a) ), h(2(+)b m (2) (+)R m (2) ), .... h(K(+)b m < K) (+)R m (K) )} from the 
bidding device 10 m (where m = 1, 2, . . . , M). 

Step SI: Write and hence publish the bidding price information on the 
bulletin board 25. 

Step S2: Set the price index k to its highest value K. 

Step S3: Request each bidding device 10 m to present the random 
number Rj®. 

Step S4: The bidding devices 10 m each send the random number Rj k) 
to the bid-opening device 20, which writes all the random numbers R m (k) on 
the bulletin board 25. 

Step S5 : Set b m (k) = 1 , then input b m (k) and R m (k) to the (+) operation part 
51 to perform an operation k(+)l(+)R m (k) , and process the result of operation 
by the one-way function h processor 22 to obtain h(k(+)l(+)R m (k) ). 

Step S6: For each m, make a check to see if a match is found between 
the calculated h(k(+)l(+)R m (k) ) and h(k(+)l(+)R m (k) ) on the bulletin board 25. 

Step S7: If no match is found, decrement k such that k<-k-\, and 
return to step S3. 

Step S8: If a match is found, determine the k as the successful price 
index k, then output the price index k and the identifier ID m of the bidding 
device 10 m concerned, and discontinue the current bid-opening session. 

As described above, according to this embodiment, the bidding price 
information corresponding to each price index is generated using the one-way 
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function and all the pieces of bidding price information are sequentially 
opened in decreasing order from the highest value. This enables non- 
winning bids to be kept secret. 

In the case of choosing the lowest price bid as the successful bid in 
5 this embodiment, the bidding device 10 m similarly sends the bidding price 
information {JD m , h(l(+)b m w (+)R m (1) ), h(2(+)bJ 2) (+)R m (2) ), .... 
h(K(+)b m (K) (+)R m (K) )} to the bid-opening device 20. The bid-opening device 
20 carries out about the same processing as depicted in Fig. 18, but in step S2 
the lowest value 1 of the K kinds of biddable price indexes is set to k and in 
10 sep S6 the index k is incremented by one such that k<-k+l . 

In the case of choosing the highest price bid as the winning bid in this 
embodiment, since random numbers Rj l) received from all the bidding 
devices for t (where k<t<K) are recorded on the bulletin board 25 in step S4, 
it is possible to detect that b m (k) = 0 for the index larger than the winning price 
15 index k, by calculating h(t(+)b m (t) (+)R m (t) ) and comparing it with 
h(k(+)b m (k) (+)R m (k) ) published on the bulletin board 25. Accordingly, any 
one can determine if the winning price index k is correct. 

In this embodiment it is also possible for each bidding device 10 m to 
send the set of random numbers {R^Hk^l,...^) to the bid-opening device 
20 20 in advance together with ID m and h(k(+)b m (k) (+)R m (k) ). In this case, 
however, the random number R m (k) is not written on the bulletin board 25 but 
is stored in the broken-lined information storage part 35. In Fig. 19 there is 
shown a flowchart for explaining the processing which the bid-opening device 
20 performs in such an instance. 
25 Sep SO: Receive the bidding price information {ID rn , 

h(1(+)bra (i) (+)Rm (i)) 5 h(2(+)bJ 2) (+)R m (2) ), h(K(+)b m (K) (+)R m (K) )} and 

random number information {R^, R m (2) , Rm (K) } from the bidding devices 
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10 m (where m = 1, 2, ...,M). 

Step SI: Write and hence publish only the bidding price information 
on the bulletin board 25 and store the random number information in the 
storage part 35 indicated by the broken line. 

Step S2: Set the highest possible value K for the price index k. 

Step S3: For all m's, generate h(k(+)l(+)R m (k) ) read out of the storage 
part 35 with b b (k) =l. 

Step S4: Verify whether a match is found between h(k(+)l(+)R m (k) ) 
and the pieces of bidding rice information written on the bulletin board 25. 

Step S5: If no match is found, decrement the price index k by one to 

k<-k-l 

and return to step S3. 

Step S6: For the index k for which the mach was found, write and 
publish all the random numbers R tn (t) (k<t<K) on the bulletin board 25. 

Step S7: Determine k at this time as the wmning price index, then 
output this index k and the identifier ED m of the bidding device 10 m having 
submitted the winning bid, and discontinue the current bid-opening session. 

When the lowest bidding price bid is chosen as the successful bid in 
this case, the index k is set to the smallest possible value, 1 in this example, in 
step S2 in Fig. 19, then in step S4 the index k is incremented by one, and in 
step S5 all random numbers which are l<t<k are published on the 
bulletin board 25. The other operations are the same as those described 
above with reference to Fig. 19. 

While in the above the select information b m (k) has been described to 
be "0" or "1," they may be any values as long as they are two predetermined 
different integers. 
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STYTH F.MBODTMENT 

In the second embodiment described previously, at the time of bidding 
each bidding device 10 m sends the bidding price information y m = g(h krtl (IV m )) 
and the verification information C m = h k+1 (IV m ) to the bid-opening device 20, 
5 and at the time of bid-opening the bid-opening device 20 requests the bidding 
device 10 m to send the information D m = h k (IVJ„ and verifies whether h(D m ) 
and C m match for the information D m received from the bidding device 10 m ; if 
they match, then the bid-opening device 20 further verifies whether g(DJ 
matches the bidding price information y m . These verifications need to be 
10 made for all of m = 1, 2, M. Accordingly, the amount of data to be 
processed increases with an increase in the number M of bidding devices used. 
In addition, the larger the highest value K of the index k, the more the amount 
of multiple processing by the one-way function h; hence it is necessary to 
process an enormous amount of data. 
15 To avoid this, the sixth embodiment utilizes one-way functions to 

transform the bidding price index to gnr^Hj*^ h K " km )g xni (IV m )), which is 
sent to the bid-opening device 20. X™ is an arbitrary integer equal to or 
greater than 1 which is determined by the bidding device 10 m . When 
inquired about whether it has bid with the index k, the bidding device 10 m 
20 presents Hj k ' l) = h^'^g^CIVJ) if k is not its aimed bidding price index k^, 
and if it is the aimed value, the bidding device 10 m presents Bj k ' l) = g^flVJ. 
The bid-opening device 20 verifies the former with hCH^ 13 ) = H m (K) and the 
latter with gCHj^) = H m (K) . 

The M bidding devices 10 m indirectly bit the bidding price index 
25 values to the bid-opening device 20, which detects the largest one of the 
index values 1^ bit by the bidding devices 1 0 m . Each bidding device 1 0 m and 
the bid-opening device 20 have a conversion table in which K bidding prices 
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PR l5 PR 2 , PR K are held in a one-to-one correspondence with K kinds of 
index values 1, 2, K in increasing order. In this embodiment, as the 
index value k (where k = 1, 2, . . . , K) increases, the value PR k becomes larger; 
for example, PRj = 10, PR 2 = 15, PR 3 = 30, . . . , PR K = 3000. 
5 Fig. 20 illustrates in block form the functional configuration of the 

bidding device 10 m and Fig. 21 is a flowchart showing its bidding procedure. 
The bidding device 10 m comprises an input part 11, a control part 13, a 
bidding price transformer 14, a transceiver 18 and a storage part 12 all of 
which are interconnected via a common bus 1 0B. The bidding price 
10 transformer 14 is made up of a conversion table 15, a one-way function h 
processor 16 and a one-way function g processor 17. The control part 13 
reads out a bidding procedure program stored in the storage part 12, and 
follows it to control the respective parts to perform bidding as described 
below. 

1 5 Step SI : The bidding device 10 m receives via the input part 11 a value 

PR,, selected from values PR 1; PR 2 , PR K , an initial value (a positive 
integer) IV m and an arbitrary integer x m equal to or greater than 1. 

Step S2: The control part 13 stores IV m and x m in the storage part 12. 
Step S3: The control part 13 refers to the conversion table 15 with PR m 
20 to convert it to an index value k m and stores it in the storage part 12. 

Step S4: The initial value IV m and the bidding price ^ are read out 
from the storage part 12, then input to the one-way function g processor 17, 
wherein the initial value is processed x m times with the one-say function g to 
obtain g™(IV m ). 

25 Step S5 : If necessary, g xm (IV ra ) is stored in the storage part 12. 

Step S6: g^IVJ, K and are input to the one-way function h 
processor 16, wherein g^CIVJ is processed K-l^ times with the one-way 
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function h to obtain 

Hffi (K) = h K- km(g x m(][Vm)) 

Step S7: Hj K) is sent as the bidding price information to the bid- 
opening device 20 via the transceiver 18. 
5 In this way, the bidding device 10 m sends the aimed bidding price 

index value k m to the bid-opening device 20. 

Step S8: Upon beginning the bid-opening procedure by the bid- 
opening device 20 after the bidding, each bidding device 10 m receives an 
inquiry with the price index k from the bit-opening device 20 by the 
10 transceiver 18 as depicted in Fig. 21. 

Step S9: A check is made to see if the inquiry index value k is equal to 
the bidding price index k m stored in the storage part 12. 

Step S10: If not equal, g^IVJ is read out of the information storage 
part 12 and is input to the one-way function h processor 16 together with 
15 and k, wherein g^IV^ is processed k-k^-1 times with the one-way function 
h to obtain response information Bj*~ l) by the following equation: 

Hm (k-l) = h k-km-l (g xm (IV j ) 

Step Sll: The bidding device 10 m sends the response information Ej- k ~ 
l) to the bid-opening device 20 via the transceiver 18 and waits for the next 
20 inquiry about k. 

Step S 12: If the inquiry about k corresponds to its aimed value, that is, 
if the index k is equal to 1^ in he storage part 12, the bidding device 10 m 
inputs the initial value IV m and x m . 1 to the one-way function g processor 17, 
wherein the initial value IV m is processed xm-1 times to obtain response 
25 information H m (k - 1} = g^QVJ. 

Step SI 3: The bidding device 10 m sends the response information Kj k ~ 
l) to the bid-opening device 20. 
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The functional configuration of the bid-opening device 20 is depicted 
in Fig. 22 and its bid-opening procedure in Fig. 23. The bid-opening device 
20 comprises a control part 21, a program storage part 27 S, a one-way 
function h processor 22, a one-way function g processor 23, a counter 24, a 
5 bulletin board 25, a conversion table 25A, a transceiver 28, and an 
information storage part 25, all of which are interconnected via a common bus 
20B. 

Step SI: Upon receiving the bidding information y m =H m (K) from each 
bidding device 10 m by the transceiver 28, the control part 21 writes the 
1 0 bidding information ~Kj K) on the bulletin board 25 to publish it. 

Step S2: Set K as the initial value of k in the counter 24. 
Step S3: Send the index value k on the counter 24 to each bidding 
device 10 m , and send thereto an inquiry about bidding via the transceiver 28. 

Step S4: Receive the response information Hj h ' l) by the transceiver 28 
15 from all the bidding devices 10 m . 

Step S5: Input H ra (k4) to the one-way function h processor 22 to 
process it with the one-way function h to obtain hCHj^). 

Step S6: Check whether the result of operation HHj 1 ^) is equal to the 
bidding information for m in the storage part 35. 
20 Step S7: If KH^) = Hj^, store the received information as 

updated bidding information H m (K) in the storage part 35 to update Hj^. 

Step S8: Decrement the count value k of the counter 24 by one, then 
return to step S3, and inquire of each bidding device 10 m about whether it has 
made a registration for the value k. 
25 Step S9: When it is found in step S6 that the response information 

H m (k " 1} from the bidding device 10 m is g^IVJ which is equal to the aimed 
index value, h(H m (k_1) ) does not become equal to H m (K) = h^^C^OV J) = 
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g^IVJ in step S9. Then, input Hj k ' l) to the one-way function g processor 
23 to process iQ k ' l) with the one-way function g to obtain g(Hj^' l) ). 

Step S10: Make a check to see if giUj^) is equal to Hj K) 
corresponding to m stored in the storage part 35. 
5 Step Sll: When the bidding device 10 m has performed correct 

processing, h^^Cg^OV J) = g^CIVJ = by the process of step S7 at 
the time of previous inquiry for k = k^; hence, gCH^" 1 *) = Hj K) holds. In 
the inquiry processing for the index k which is decremented one by one, the 
index k for which gCH m (k>1) ) = H m (K) holds for the first time is the maximum 
10 value among the bidding price indexes of all the bidding devices, and this 
index k is converted to the value PR k by referring to the conversion table 25 A. 

Step S12: Output the value PR k as the highest one of the bid values, 
and if necessary, output the number m of the winning bidding device 10 m as 
well. 

1 5 In the bidding procedure of Fig. 21, if k = ^ in step S9 when inquired 

about whether it has bid k, the bidding device 10 m may send to the bid- 
opening device 29 in step S13 not only the response information Hj*" 1 ' but 
also information indicating k = (which information will hereinafter be 
referred to as identity information). In this instance, upon receiving the 

20 response information H m (k_1) in step S4 in Fig. 23, the bid-opening device 20 
makes a check for the identity information; if not having received it, the 
device 20 performs the operation h(H ra (k l) ) and if having received the 
information, g(H m (k4) ). Incidentally, in the event that g(H m (k - 1} ) * H m {K) in 
step S10 in Fig. 23, the bid-opening device 20 may discontinue the current 

25 bid-opening session for the reasons of dishonesty by the bidding device 
concerned and request all the bidding devices 10 m to rebid; alternatively, the 
bid-opening device 20 may abandon inquiring that bidding device but may 
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continue inquiring the other bidding device. 

In the case where the bidding prices PR k are arranged on each of the 
conversion tables 15 and 25 A in such a decreasing order as 3000, 2950, 2900, 
100 in correspondence with the K index values 1,2, K, the price PR k 
5 corresponding to the index value k for which gOH^" 15 ) = holds for the 
first time in the inquiry about bidding k represents the lowest one of the aimed 
bidding prices of all the bidding devices 10 m . The maximum value of the 
index may also be obtained without using the conversion table 15. In this 
instance, the bidding device 10 m sends the index value and after step S10 
10 in Fig. 23 the bid-opening device 20 outputs the index value k as the highest 
value and, if necessary, together with the number m (or ID J of the bidding 
device 10 m having sent the index value k m . 

In the bid-opening procedure depicted in Fig. 23, the bid-opening 
device 20 inquires every bidding device 10 m for each value of the index k = K, 
15 K-l, K-2, . . . , and receives Hj*" 0 , and then processes it using the one-say 

function h in step S5; hence this procedure requires high communication cost 
and computational complexity. In Fig. 24 there is depicted a modified form 
of the above-mentioned bid-opening procedure whose communication cost 
and computational complexity are reduced using the scheme described 
20 previously with reference to Fig. 11. No description will be given of the 
bidding procedure since it is exactly the same as in the Fig. 11 embodiment. 

Step SO: Receive bidding price information - h^g^IVJ) 
and the identifier ID m from each bidding device. 

Step SI : Publish the received H m (K) and BD m on the bulletin board 25. 
25 Step S2: Set the initial value of the index k at K. 

Step S3: Inquire of all the bidding devices 10 m about whether they bid 
for the index k. 
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Step S4: Check the responses for YES (which means that the bidding 
device concerned has bid for the index k). 

Step S5: If no YES is found, decrement k by one and returns to step 
S3 to repeat the same processing. 

Step S6: If YES is found, request all the bidding devices 10 m to send 
their bidding price information H ra (k " 1) . The response of the bidding device to 
this request is the same as described previously in connection with Fig. 21 . 

Step S7: Publish the received information Hj*' l) on the bulletin board 

25. 

Step S8: For the response Bj- kA) of an m (representing the bidding 
device 10 m ) having bid for the index k, compute 

H m = h K ^g(H m (k - 1> ) 
and for the responses Hj 1 ^ from the other m's (the other bidding devices), 
compute 

H m = h K+1 - k (H m (k - 1} ). 

Step S9: Check whether = H m (k) holds for all the m's, and if a 
mismatch is detected for even one of them, send an error message to all the 
bidding devices and discontinue the current bid-opening session. 

Step S10: If a match is detected for every one of them, determine that 
the bidding device 10 m of the number m having responded YES is the winning 
bidder, and output the index k at that time and its identifier ED m for 
publication 

The bidding device 10m and the bid-opening device 20 can each be 
implemented by a computer. 

SEVENTH EMBODIMENT 

In the fifth embodiment described previously, each bidding device 10 m 
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generates the select information b m (k) indicating whether to bid for every price 
index k = 1, 2, K, and these pieces of select information are contained in 
K pieces of information h(k(+)b b (k) (+)R m (k) ), where k = 1, 2, K. In this 
embodiment, however, the plural pieces of select information are contained in 
5 a single piece of bidding price information through multiple processing with 
the one-way function h. 

Fig. 25 illustrates in block form the functional configuration of each 
bidding device 10 m . Assume that K bidding prices PR and the k price 
indexes k = 1, 2, K, which have a one-to-one correspondence with each 
10 other, are both arranged in monotone increasing order in the same direction. 
The bidding select information for each index k will be identified as b (k) . In 
this embodiment a select information generating part 54 does not generate the 
select information b m (k) for all the indexes k = 1, 2, . . . , K but instead generates 
the select information b m (k) only for indexes higher than the bidding price 
1 5 index = KHj^l |b m (k) ) is calculated, with R m (kmA) = IV m as its initial 

value, for each value of the price index k (=1^, 1^+1, K) by a one-way 
function h processor 16, a concatenator 55 and a buffer 56, and the calculation 
result H m (k) for each value of k is stored in a data storage part 14S. The final 
calculation result Ej K) will hereinafter be called bidding price information. 
20 In this embodiment, a signature Sig m (H m (K) ) is generated by a signature 
generator 14S for the bidding price information 57. 

Fig. 26 is a flowchart showing the bidding procedure of the bidding 
device 10 m depicted in Fig. 25. 

In this embodiment, letting k m be the index that the bidding device 10 m 
25 bids, a select information generating part 54 generates K-kJ-1 pieces of select 
information b m (km) , b m (km+1) , b b (K) corresponding to the indexes larger than 
the bidding price index k m (step SI). Then, H^, Bj^\ H^, .... 
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H m (K) are successively generated by the following equations 

j^(km-l) = jy^ 

H in ( km ) = h(H m (km " 1) ||b m (km) ) 
H^^-h^^HbJ^^) 

H m (t) = hCH m (t - 1) ||b m (t) ) 

and they are stored in the data storage part 14S (step S2). Further, a 
signature a m = Sig m (H m (K) ) of the bidding device 10 m corresponding to the 
bidding price information H m (K) is generated by the signature generator 14 S 
(step S3). The bidding device 10 m sends Hj^, a m and ID m as bidding 
information to the bid-opening device 20 (step S4). After this, the bid- 
opening procedure is started, and upon receiving an inquiry for each value of 
the index k, the bidding device reads out b m (k) } from the data storage 

part 14S, and sends it to the bid-opening device (step S5). 

The bid-opening device 2- comprises, as depicted in Fig. 27, a control 
part 21, a one-way function h processor 22, a counter 24, a bulletin board 25, 
an information storage part 35, comparators 58 and 59 and a signature verifier 
33. The pieces of bidding information Bj K \ a m and E) m are written on the 
bulletin board 25. Then, the received information Hj 1 ^ is processed by the 
one-way function h processor 22 to obtain Hj*> = h(H m (k - 1) ), which is 
compared by the comparator 58 with Hj- k) read out of the bulletin board 25 to 
thereby verify whether they match. Further, it is checked by the comparator 
59 whether the received select information b m (k) is 1, and if it is 1, then the 
bidding device 10 m corresponding to m at that time is determined as the 
winning bidder. 
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Fig. 28 is flowchart showing the bid-opening procedure of the bid- 
opening device 20. 

The bid-opening device 20 verifies respective signatures a m (where m 
= 1 , 2, . . . , M) and writes and publish the received pieces of information Hj K \ 
5 <y m and ID m on the bulletin board 25. 

The bid-opening device 20 sends k to the bidding device in the order 
[k = K, K-l, K-2, ...] and asks for information {Hj 1 ^, b m (k) } corresponding 
to each index k. The information {H m (k " 1) , b m (k) } received from each bidding 
device 10 m is published on the bulletin board 25, then it is checked whether 
10 H m (k) = h(H m (k " 1) ,b m (k) ) holds for the information received previously, and 
if it holds, it is checked whether the select information b m (k) is 1 . When b m (k) 
is 0 for all of m = 1, 2, M, the bid-opening device 20 decrements k to 
k<-k-l, then sends again k to the bidding device and asks for the information 
{H m (k_i) , b m (k) }, thereafter performing the same operation as described above. 
15 If the select information b m (k) is 1 for any one of m = 1, 2, M, then the 
bidding device 10m corresponding to that m is determined as the winning 
bidder. The bid-opening device 20 publishes the successful bidding price 
index and the identifier ID m of the wining bidding device 10 m on the 
bulletin board 25. 

20 According to this embodiment, since each bidding device does not 

perform the multiple processing with the one-way function for indexes 
smaller than the bidding price index k^, the computational complexity is low 
accordingly. 

The bid-opening device performs the bid-opening procedure as 
25 described below. 

Step SO: Receive the pieces of bidding information Hj 10 , a m and ID m 
from each bidding device, then verifies respective signature a m (where m = 1, 
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2, M), and writes and publishes the pieces of information Bj- K \ cj m and 
ID m on the bulletin board 25. 

Step SI : Set the initial value of the index k to K. 

Step S2: Send k to each bidding device 10 m and ask for {H m (k " L) , b m (k) }. 

Step S3: Write and publish on the bulletin board 25 the information 
{H m (k ~ 1} , b m (k) } received from each bidding device 10 m . 

Step S4: Process the received information {Hj 1 ^, b m (k) } by the one- 
way function h processor 22, thereby generating H = h(H m (k " 1) Hb m (k) ). 

Step S5: Verify by the comparator 58 whether H generated in step S4 
matches the previously received Hj k \ If a mismatch is detected, then send 
an error message to the bidding device and discontinue the current bid- 
opening session. 

Step S6: If no mismatch is found in step S5, then decides that the 
response from every bidding device is valid, and make a check by the 
comparator 59 to see if the received select information b m (k) is 1. 

Step S7: When the select information b m (k) from all bidding devices 
10 m is 0, update k with k-1 and return to step S2. 

Step S8: When any one of M pieces of select information b m (k) is 1 in 
step S6, determine that the bidding device 10 m corresponding to m, which 
provides that information b m (k) , is the winning bidder, and write and publish its 
identifier ID m and the index k k of the winning bid on the bulletin board 25, 
and end the bid-opening procedure. 

In this embodiment the prices bid by the unsuccessful bidders are each 
kept secret from the other participants. The lowest price bid can be made a 
successful bid by using a conversion table wherein the price PR 
monotonously increases in the direction opposite to that in which the index k 
monotonously increases. 
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Incidentally, it is also possible to set H m (0) = IV m , Hj" = HH^IIb^), 
. . . , H,™ = h(Hj K - l) \\bJ K \ where b m (1) - b m (2) = . . . = b m (km ' l) = 0. 

The communication cost and computational complexity involved in 
the bid-opening procedure of Fig. 27 can also be reduced, as depicted in Fig. 
5 27 ', by the application of the scheme described previously with reference to 
Fig. 1 1 . The bidding procedure is exactly the same as in Fig. 25, and hence 
it will not be described. 

Step SO: Receive the bidding price information Uj K) = h(. . .KKHj^ 
L) il b m (km) )|| b m (km+1) ). . . i| b m (K) ) and the identifier ID m from each bidding device. 
1 0 Step S 1 : Publish the received H m (K) and ID m . 

Sep S2: Set the initial value of the index k at K. 
Step S3: Inquire of all the bidding devices 10 m about whether they bid 
for the index k. 

Step S4: Check the responses for YES (which means that the bidding 
1 5 device concerned has bid for the index k). 

Step S5: If no YES is found, decrement k by one and returns to step 
S3 to repeat the same processing. 

Step S6: If YES is found, request all the bidding devices 10 m to send 
their bidding price information Hj^ = h(. . .KKHj^lj bj°*)\\ b m (to+1) ). . . || 
20 b m (K) ). The response of the bidding device to this request is the same as 
described previously in connection with Fig. 2 1 . For the bidding device 
having bid for the current index k, k = therefore, = H m (km ' 11 = IV m . 

Step S7: Publish the received information Bj kA) on the bulletin board 

25. 

25 Step S8: For the response Hj kA) of an m (representing the bidding 

device 10 J having bid for the index k, compute 
H m = h(...h(h(H m < k - 1) || 1)||0)||...0) 
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and for the responses H^"^ from the other m's (the other bidding devices), 
compute 

H m = h(...h(h(H m < k - 1) )H0)|| 0)...||0). 

Step S9: Check whether = Hj k) holds for all the m's, and if a 
5 mismatch is detected for even one of them, send an error message to all the 
bidding devices and discontinue the current bid-opening session. 

Step S10: If a match is detected for every one of them, determine that 
the bidding device 10 m of the number m having responded YES is the winning 
bidder, and output the index k at that time and its identifier ID m for 
10 publication. 

EIGHTH EMBODIMENT 

In each of the embodiments described above, the bidding prices for the 
bidding price indexes k = 1, 2, K in the conversion table are discrete 

1 5 values such as 1 000, 2000, 3000, . . . , 1 0000, and each bidding device bids any 
one of the K prices but cannot bid a value intermediate between such discrete 
prices unless K prices are set in "1" increments. This embodiment is 
intended to permit bidding an arbitrary price intermediate between the 
discrete values. In this embodiment, an arbitrary bidding price PR within the 

20 range defined by the highest and lowest bidding prices is expressed by the 
following equation. 

PR =F(k) + Q 

where: 0 < Q < F(k+1) - F(k) 
F(k) represents the price corresponding to the index k specified on the 
25 conversion table, and Q will hereinafter be referred to as a fraction. 

This embodiment is one that the bidding price PR defined above is 
applied to the first embodiment described previously. Bidding price 
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information g(h k (IV m )) and Q m are sent to the bid-opening device 20. 
Further, h K+1 (IV m ) is sent as verification information to the bid-opening device 
20 together with the bidding price information. These pieces of information 
are published on the bulletin board as is the case with the first embodiment. 

Fig. 30 is a block diagram illustrating the configuration of each 
bidding device 10 m , which is identical with the bidding device of the first 
embodiment except that the bidding price transformer 14 is provided with a 
fraction calculating part 14a. The fraction calculating part 14A calculates, 
for a desired bidding price PK^, Q m = PR^FCkJ from the index 1^ read out 
of the conversion table 15. As is the case with the first embodiment, the 
one-way function h processor 16 and the one-way function g processor 17 are 
used to compute y m = gCh^IVJ) from the index which satisfies 
F(k m +l)>PR m >F(k m ) and the initial value IV m . In this embodiment, y m , Q m 
and ED m are sent as bidding information to the bid-opening device 20. 

The bid-opening device 20 has, as depicted in Fig. 31, a sequencer 61 
added to the bid-opening device 20 in Fig. 6 embodiment. The pieces of 
bidding information y m , Q m and DD m are written and published on the bulletin 
board 25 . The sequencer 61 reads out Q 1; Q 2 , . . . , Q M from the bulletin board 
25, then sequences them in descending order, and sequences m = 1, 2, M 
corresponding to the sequenced Q m , thereafter outputting them in the 
sequential order. The control part 21 checks, for each index k, whether ED m 
and y m match each other in the sequence of m defined by the sequencer 61. 
The bidding device 10 m , which corresponds to m for which the match was 
detected for the first time, is determined as the winning bidder. 

Fig. 32 is a flowchart depicting the bid-opening procedure of the bid- 
opening device 20 shown in Fig. 31, which steps SO to S7 are identical with 
steps SO to S7 in Fig. 7 but differ in step 8 and the subsequent steps. 



42 



Roughly speaking, steps S8 and S9 are new steps added between steps S7 and 
S8 in Fig. 7. Step S8 and the subsequent steps will be described below. 

In step S8 the bid-opening device 20 makes a check to determine 
whether the matching in steps S6 to Sll has been completed for all fractions 
Q m for the current value of k. If not completed, the procedure goes to step 
S9. In step S9, the bid-opening device 20 selects the largest one of the 
remaining fractions Q m to determine the corresponding m. In step S10, the 
device 20 reads out of the data storage part 36 updated data D m (k) =h k (IV m ) 
corresponding to that m, and processes the read-out data by the one-way 
function g processor 23, thereby updating it such that D m (k) <^g(D m (k) ). In 
step Sll, the control device 21 makes a check to see if the updated data D m (k) 
corresponding to m matches the bidding price information y m corresponding 
to m on the bulletin board 25, and if not, then the procedure returns to step S8. 

When it is decided in step S8 that the matching for all the fractions Q m 
for the current k has been completed, the bid-opening device 20 decrements k 
by one in step S12, and returns to step S8, repeating the same procedure as 
mentioned above. When it is decided in step Sll that the updated data D m (k) 
and the bidding price information y m match, the bid-opening device 20 
determines in step S13 that the index k at that time is the successful index, 
and outputs the identifier ID m corresponding to that information y m and the 
successful bidding price F(k)+Q m (or merely the index k). 

Since D m (k) and gm are matched for the current value of the index k in 
the descending order of the fractions Q m as described above, the highest 
bidding price can be determined at the first detection of matching between 
D m (k) and y m . The value m selected in step S9 is determined by the sequencer 
61 which sequences in descending order the fractions Q 1; Q 2 , Q M read out 
of the bulletin board 25, and sequences m correspondingly, as explained 
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before. 

In the case where the lowest bidding price bid is a successful bid, the 
bidding prices are arranged in monotonous increasing order in the direction 
opposite to that in which the values of the index k are arranged in monotonous 
5 decreasing order, and the sequencer 61 sequences the fractions Q l5 Q 2 , Q M 
in ascending order, and sequences m correspondingly. In step S9 the 
smallest one of the unprocessed fractions Q m is chosen, and the corresponding 
m is determined. The sequencer 61 determines the order of m. 

The technique that uses may fractions Q m as described above can be 
10 applied not only to the first embodiment but also to the other embodiments 
explained heretofore. 

Electronic Co m petitive Auction System With Provisional Identifier Device 

In the embodiments described above, since the bidding device 
15 identifier ED m is contained in the bidding information and sent to the bid- 
opening device 20, it can be said that these embodiments employ what is 
called a sealed-bit auction system. Fig. 33 illustrates in block form an 
electronic competitive auction system which uses a provisional identifier 
registration device to implement a secret-bit auction. 
20 Each bidding device 10 m is adapted to communicate with a provisional 

identifier registration device 70. Referring to Fig. 34, the operation of this 
electronic competitive auction system will be described below. 

Step SO: Notice of auction is input to each bidding device 10 m . 
Step SI: Upon receiving the notice of auction, the bidding device 10; 
25 outputs the identifier ED m to the provisional identifier registration device 70. 

Step S2: For the identifier ID m provided thereto, the provisional 
identifier registration device 70 issues a provisional identifier AID m , then 
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stores BD m and AID m m pair form on a recording medium 71, and sends the 
provisional identifier ATD m to the bidding device 10;. 

Step S3: The bidding device 10 m : generates the bidding price PR m ; 

Step S4: Transforms the bidding price PR m to the bidding price 
information y m ; and 

Step S5: Sends the bidding price information y m and the provisional 
identifier ATD m to the bid-opening device 20. 

Step S6: The bid-opening device 20: calculates a successful bid from 
the bidding price indexes received from all the bidding deices; and 

Step S7: Outputs the successful bid and the provisional identifier of 
the bidding device having offered the successful bid. 

Thus, it is possible to keep the auction participants secret. 
Incidentally, when inquiring the provisional identifier registration device 70, 
the bid-opening device 20 can learn the identifier JD m corresponding to the 
successful bid from the provisional identifier AID m . This method can be 
applied to all of the embodiments explained hereinbefore. 

The bidding device 10 m and the bid-opening device 20 can be 
implemented by interpreting and executing programs with a computer. 

EFFECT OF THE INVENTION 

As described above, according to the present invention, since the 
bidding price is transformed to a bidding price information through utilization 
of a one-way function and is then sent to the bid-opening device, it is possible 
to keep the bidding price of each bidding device secret from the other bidding 
devices prior to bidding, ensuring fairness of auction. 

By publishing h K+1 (IV m ) and h kmx (IVJ corresponding to a winning 
bidding price on the bulletin board, it is possible for all bidding devices to 



verify whether the winning bidding price was correctly bid without being 
altered. 

Furthermore, the present invention permits determination of the 
winning bid while hiding the other bidding prices. 
5 According to the second embodiment, the bids of losing bidders, 

except the winning bid, are kept secret even from the bid-opening device. 

According to the third embodiment, the bids of losing bidders, except 
the winning bid, are kept secret even from the bid-opening device, and in 
addition, the amount of data for communication with the bidding device can 
10 be reduced. 

According to the fourth embodiment, there is no fear of the bidding 
price of each bidding device being revealed to the other devices, and at the 
bid-opening time the successful bid can easily be specified directly from the 
bidding price; furthermore, the validity of the winning bid can be verified. 

15 According to the fifth embodiment, bidding price information 

including each bidding price index is generated using a one-way function, and 
the bidding price information for all bidding price indexes is sent to the bid- 
opening device; hence, the aimed bidding price can be kept secret. 

According to the sixth embodiment, either hCHj 1 '" 13 ) = H m (K) or gCHj 1 "" 

20 1} ) = Hj® needs only to be verified for each index value and for each bidding 
device. 

According to the seventh embodiment, each bidding device generates 
the bidding price information including select information for only indexes 
larger than the bidding price index in the fifth embodiment, the 
25 computational complexity can be reduced. 

According to the eighth embodiment, since a desired bidding price is 
expressed by the sum of fractions Q of a price F(k) corresponding to the index 
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k, an arbitrary price can be bid with a small number of indexes. 
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WHAT IS CLAIMED IS: 

1 . A quantitative competition method for a system in which a plurality 
of participant devices send their secret aimed values to a server device and 

5 said server device determines which of said plurality of participant devices 
has offered the maximum or minimum one of said aimed values received, said 
method comprising the steps wherein: 

(a) each of said participant devices processes an initial value peculiar 
to said participant device with a predetermined one-way function by the 

10 number of times corresponding to said aimed value to generate aimed value 
information; 

(b) either one of said each participant device and said server device 
processes said initial value with said one-way function to generate an updated 
initial value; 

1 5 (c) said server device makes a check for matching between said 

updated aimed values and said aimed value information of said participant 
devices; and 

(d) upon first detection of matching in said step (c), said server device 
decides that said aimed value of that one of said participant devices which 
20 corresponds to said updated value having matched said aimed value 
information is maximum or minimum. 

2. The method of claim 1, further comprising a step of repeating the 
updating of said initial value in said step (b) and the check for matching in 
said step (c) when no matching is detected in said step (c). 

25 3. The method of claim 2, wherein said step (b) includes a step of 

generating said updated initial value by said server device. 

4. The method of claim 3, wherein: there is provided a conversion 
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table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values 
corresponding thereto; 

said step (a) includes a step wherein, letting M be the number of 
5 participant devices, an m-th participant device m computes said aimed value 
information by 

Y m = g(h kra (IVJ) 

where g is a one-way function, IV m is said initial value, 1^ is an index 
corresponding to said aimed value of said participant device m, and h km (I V m ) 
10 indicates that said initial value IV m is processed with said one-way function h 
by k m times; 

said step (b) includes a step wherein said server device generates said 
updated initial value by 

D m = g(h k (IV m )); and 
15 said step (c) includes a step of making a check for said aimed value 

information y m = D m . 

5. The method of claim 2, wherein said step (b) includes a step 
wherein said each participant device generates said updated value by the 
number of times requested by said server device and sends said updated initial 

20 value to said server device. 

6. The method of claim 5, wherein: there is provided a conversion 
table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values 
corresponding thereto; and 

25 said step (a) includes the steps wherein: 

(a-1) letting M be the number of participant devices, an m-th 
participant device m computes said aimed value information by 
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Y m = g(h km (IVJ) 

where g is a one-way function, IV m is said initial value, is an index 
corresponding to said aimed value of said participant device m, and h km (IV m ) 
indicates that said initial value IV m is processed with said one-way function h 
5 by k m times; 

(a-2) said each participant device generates verification information 
C m = h K+1 (IV m ) and sends it to said server device together with said aimed 
value information y m ; and 

(a-3) said server device publishes said aimed value information y m and 
10 said verification information C m = h K+1 (IV m ) received from said each 

participant device on a bulleting board accessible from all of said participant 
devices. 

7. The method of claim 6, wherein: said step (b) includes the steps 
wherein: 

15 (b-1) said server device requests said each participant device to send 

D m = h k (IV m ) corresponding to said index k; and 

(b-2) said each participant device responds to the request of said 

server device to generate D m = h k (IV m ) corresponding to said index k as said 

updated initial value and sends it to said server; and 
20 said step (c) includes a step of generating g(D m ) and making a check 

for said aimed value information y m = g(D m ). 

8. The method of claim 7, wherein: said step (b) includes a step (b-0) 
wherein said server device sets said index k to an upper limit value K; and 

said step (c) includes the steps wherein said server device: 
25 ( c- l) publishes said D m = h k (IV m ) received from said each participant 

device on said bulletin board; 

(c-2) computes said g(D m ) for said each participant device m; 
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(c-3) makes a check to see if said g(D m ) matches said aimed value 
information; 

(c-4) if no match is detect for any of said m in said step (c-3), replaces 
said D m with said C m , decrementing said index k by one and returns to said 
step (b-1); and 

(c-5) if a match is detected in said step (c-3), determines that the value 
corresponding to said index k at that time is said maximum or minimum 
aimed value. 

9. The method of claim 8, wherein said step (c-1) includes a step 
wherein said server device generates h(D m ) and makes a check to see if h(D m ) 
= C m holds. 

10. The method of claim 8, wherein said step (c-5) includes a step 
wherein said server device publishes said determined maximum or minimum 
aimed value and said h km (IV m ) on said bulletin board. 

11. The method of claim 5, wherein: there is provided a conversion 
table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values 
corresponding thereto; and 

said step (a) includes the steps wherein: 
(a-1) letting M be the number of participant devices, an m-th 
participant device m computes said aimed value information by 
Y m = g(h km (IV m )) 

where g is a one-way function, IV m is said initial value, 1^ is an index 
corresponding to said aimed value of said participant device m, and h km (IVJ 
indicates that said initial value IV m is processed with said one-way function h 
by k m times; 

(a-2) said each participant device generates verification information 
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C m = h K+1 (IV m ) and sends it to said server device together with said aimed 
value information y m ; and 

(a-3) said server device publishes said aimed value information y m and 
said verification information C m = h K+I (IV m ) received from said each 
participant device on a bulleting board accessible from all of said participant 
devices; 

said step (b) includes the steps wherein: said server device: 

(b-0) said server device sets said index k to an upper limit value K; 

(b-1) said server device inquires said each participant device m about 
whether said aimed value information corresponds to said index; 

(b-2) said server device checks whether an answer from said each 
participant device acknowledges said correspondence; 

(b-3) if said answer from said each participant device denies said 
correspondence, said server device decrements said k by one and returns to 
said step (b-1); 

(b-4) if said answer from said each participant device acknowledges 
said correspondence, said server device requests said each participant device 
to present an updated initial value h k (IV m ); 

(b-5) said each participant device generates D m = h k (IV m ) using said 
initial value IV m of its own and sends said D m to said server device; and 

(b-6) said server device publishes said D m from said each participant 
device on said bulletin board; and 

said step (c) includes the steps wherein said server device: 

(c-1) generates h(D m )'s for all of said D m 's received from all of said 
participant devices; 

(c-2) checks whether said h(D m )'s match said verification information 
C m 's on said bulletin board, respectively; 
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(c-3) if no mismatch is detected in said step (c-1), generates g,(D ) for 
Dj presented by a participant device j having bid; 

(c-4) checks whether said g(Dj) matches said aimed value information 
Yj of said participant device j on said bulletin board; and 
5 (c-5) if said g(Dj) matches said y- } in said step (c-4), decides that said 

participant device j sent to said server device said aimed value information 
corresponding to said aimed value k. 

12. The method of claim 1, wherein: there is provided a conversion 
table showing the relationships between a sequence of values selectable as 
1 0 said aimed values and a sequence of indexes k of integral values 
corresponding thereto; and 

said step (a) includes the steps wherein: 

(a-1) letting M be the number of participant devices, an m-th 
participant device m computes said aimed value information by 
15 Y m = g(h km (IV m )) 

where g is a one-way function, IV m is said initial value, is an index 
corresponding to said aimed value of said participant device m, and h km (IV m ) 
indicates that said initial value IV m is processed with said one-way function h 
by k m times; 

20 (a-2) said each participant device generates verification information 

C m = h K+1 (IV m ); 

(a-3) said each participant device m generates h(PR m (+)R m ) from a 
random number and said aimed value PR^ and sends said h(PR m (+)R m ) to 
said server device together with said y m and said C m , said (+) represents a 
25 predetermined arbitrary operation; 

said step (b) includes the steps wherein: 

(b-1) said server device publishes its received y m , h(PR m (+)R m ) and 
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ID m on said bulletin board; 

(b-2) said server device requests said each participant device to 
present said aimed value PR^ and said random number R^; 

(b-3) said each participant device sends said aimed value PR^ and said 
5 random number R^ to said server device; 

(b-4) said server device determines from its received PR^ and R^ an 
index k corresponding to the maximum one of said aimed values and a 
participant device j having sent said aimed value information corresponding 
to said index k; 

10 (b-5) said server device request all of said participant devices to 

present h k (IV ra ); and 

(b-6) said each participant device generates D m =h k (IV m ) as said 
updated initial value using the initial value IV m of its own, and sends said 
D^h^IVjJ to said server device; 
15 said step (c) includes the steps wherein said server device: 

(c-1) publishes all of its received D m 's on said bulletin board; 
(c-2) generating h(D m )'s for all of said D m 's; 

(c-3) checks whether said h(D m )'s match said verification information 

C m 's on said bulletin board, respectively; 
20 (c-4) if no mismatch is detected in said step (c-3), generates g(D,) for 

Dj presented by said participant device j having sent said maximum aimed 

value determined in said step (b-4); and 

(c-5) checks whether said g(Dj) matches said aimed value information 

y, of said participant device j on said bulletin board; and 
25 said step (d) includes a step wherein if a match is detected in said step 

(c-5), said server device decides that said participant device j sent said aimed 

value information for said aimed value k. 
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13. The method of claim 12, wherein said step (d) includes the steps 

of: 

(d-1) generating E m = gCh^h^IV J) for t such that k<t<K and for all 
of said m's except said j; 
5 (d-2) checking whether these E m 's match said aimed value information 

y m on said bulletin board; and 

(d-3) if no match is detected in said step (d-2), deciding that said k is 
an index corresponding to the maximum or minimum aimed value, and 
outputting said k and said identifier ID m of said participant device j having 
10 presented said aimed value. 

14. The method of claim 12 or 13, wherein: said each participant 
device m adds to the computation using said aimed value PJR^ and said 
random number in said step (a-3) additional information I m about said 
aimed value information by said each participant device m, and outputs 

15 h(PR m (+)I m (+)R m ); and 

in said step (b-2) said server device requests all of said participant 
devices to present said additional information I m as well as said aimed value 
PRjn and said random number R^. 

15. The method of claim 1, wherein: there is provided a conversion 
20 table showing the relationships between a sequence of values selectable as 

said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto; 

said step (a) includes the steps wherein: 

(a-1) each said bidding device generates h(H m (K) ) as aimed value 
25 information of said each participant device by repeating, for each of a 

sequence of index values k from at least k^ corresponding to an aimed value 
of said each participant device to an upper limit index value K, processing of: 
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combining an initial value of said each participant device with select 
information to provide combined information and 

operating a one-way function h on said combined information to 
generate an updated value, said select information indicating whether said 
5 each index value k is an aimed value or not; and 

sends said aimed value information Hj^to said server device; 

(a-2) said server device publishes said received aimed value 
information H m (K) on a bulletin board accessible from all of said participant 
devices; 

10 said step (b) includes the steps wherein: 

(b-1) said server device requests said each participant device to send 
an updated initial value {Hj k ' l) , b m (k) } corresponding to each value of said 
index k in the descending order from K; and 

(b-2) said each participant device generates and sends {Hj 1 ^, b m (k) } 
15 as said updated initial value to said server device; 

said step (c) includes the steps wherein said server device: 
(c-1) publishes on said bulletin board said updated initial value {Rj kA \ 
b ra (k) } received from said each participant device; 

(c-2) processes said updated initial value Hj® with a one-way 
20 function h to generate 1^= KHj^llb^); 

(c-3) checks whether said updated initial value H m (k) matches 
received previously; and 

(c-4) if a match is detected in said step (c-3), decides whether said 
select information b m (k) represents that the corresponding index k is the index 
25 1^ of said aimed value; and 

said step (d) is a step wherein if the result of decision in said step (c-4) 
is true, said server device outputs said index concerned and the corresponding 
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participant device number m, and if the result of decision is false, said server 
device returns to said step (b) and repeats processing for the next index value 
k. 

16. The method of claim 1, wherein: there is provided a conversion 
5 table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto; 

said step (a) includes the steps wherein: 

(a-1) upon each processing of said initial value with said one-way 
10 function h, said each participant device generates an updated initial value by 
adding said processed initial value with select information b m (k) indicating 
whether said processed initial value is an aimed value for one value of said 
index k, and generates H m (k) by repeatedly performing this processing from at 
least that index of a sequence of indexes which corresponds to said aimed 
1 5 value to the upper limit value K, and sends said H m (k) as said aimed value 
information to said server device; 

(a-2) said server device publishes its received aimed value information 
H m (K) on a bulletin board accessible from all of said participant devices; 
said step (b) includes the steps wherein: 
20 (b-1) for each value of said index k in descending order from K, said 

server device inquires said each participant device about whether it has bid for 
said index k, and said each participant device responds YES or NO to said 
inquiry; 

(b-2) upon first detection of the response YES, said server device 
25 requests said each participant device to send its updated initial value H m (k " 1) ; 
and 

(b-3) said each participant device generates and sends (Hj 1 ^ = hCHj 1 "" 
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2) ll bm (k 1} ) as sa id updated initial value to said server device; 

said step (c) includes the steps wherein said server device: 
(c-1) publishes on said bulletin board said updated initial value (Hj k ~ 
l) ) received from said each participant device; 
5 (c-2) letting a and a represent predetermined values of said select 

information b m (k) indicating bidding and not bidding, respectively, generate, 
for said participant device m having bid for the current index k, 

H m = h(...h(h(H m *- 1 Jjla)||a)...||a) 
through the use of said updated initial value Hj^, and for every one of the 
10 other participant devices m, generate 

H m = h(...h(h(H m (k - 1) ||a)||a)...||a) 
through the use of said updated initial values HJ*" 1 ^ 

(c-3) checks whether said H m for said each participant device matches 
said H m (k) published on said bulletin board; and 
15 (c-4) if a match is detected in said step (c-3), determines that said 

participant device having responded YES is the winning bidding device, and 
publishes the current value of said index k as the index of the aimed value 
of said winning bidding device. 

17. The method of claim 1, wherein: there is provided a conversion 
20 table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto, and let the initial value of said each participant device 
be represented by IV m , where m = 1 , 2, . . . , M, M being an integer equal to or 
greater than 2; 

25 said step (a) is a step wherein said each participant device generates 

H m (K) = h K4cm (g xm (IV m )) using a predetermined positive integer x^, said initial 
value IV m and one-way functions h and g, and sends said H m (K) as said aimed 
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value information to said server device; 

said step (b) includes the steps wherein: 

(b-1) said server device publishes said aimed value information ^ on 
a bulletin board accessible from all of said participant devices; 

(b-2) said server device sends said index k to said each participant 
device to ask for its updated initial value; 

(b-3) said each participant device decides whether its received index k 
is the index corresponding to said aimed value; 

(b-4) if the result of decision in step (b-3) is k = k^, said each 
participant device generates and sends Hj k ' l) = g^IVJ as said updated 
initial value to said server device; and 

(b-5) if the result of decision in said step (b-3) is not k = k^ said each 
participant device generates and sends B^ m) = h^'^g^IVJ) as said 
updated initial value to said server device; 

said step (c) includes the steps wherein said server device: 

(c-1) processes said updated initial value Hj 1 ^ with said one-way 
function h to generate h(H m (k>1) ); 

(c-2) decides whether said h(H m (k_1) ) is equal to said aimed value 
information H m (K) ; 

(c-3) if it is decided in said step (c-2) that they are equal, updates said 
aimed value information H m (K) with said updated initial value Hj k ' l \ then 
decrements said index k by one and return to said step (b-2); 

(c-4) if it is decided in said step (c-2) that they are not equal, processes 
said updated initial value H m (k_1) with said one-way function g to generate 
g(Rj^); and 

(c-5) decides whether said g(H m (k_1) ) matches said aimed value 
information H m (K) ; and 
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said step (d) is a step wherein if a match is detected in said step (c-5), 
decides that the aimed value of said participant device corresponding to m and 
k having provided said match is the maximum or minimum. 

18. The method of claim 1, wherein: there is provided a conversion 
5 table showing the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto; 

said step (a) includes the steps wherein: 

(a-1), letting the initial value of said each participant device be 
1 0 represented by IV m , where m = 1 , 2, ...,M,M being an integer equal to or 
greater than 2, said each participant device generates Hj^ = h K " ksn (g xm (IVJ) 
using a predetermined positive integer x^, said initial value IV m and one-way 
functions h and g, and sends said H m as said aimed value information to said 
server device; and 

1 5 (a-2) said server device publishes its received aimed value information 

H m (K) on a bulletin board accessible from all of said participant devices; 
said step (b) includes the steps wherein: 

(b-1) for each value of said index k in descending order from K, said 
server device inquires said each participant device about whether it has bid for 
20 said index k, and said each participant device responds YES or NO to said 
inquiry; 

(b-2) upon first detection of the response YES, said server device 
requests said each participant device to send its updated initial value Hj 1 ^; 

(b-3) said each participant device decides whether its received k is the 
25 index k corresponding to said aimed value; 

(b-4) if the result of decision in said step (b-3) is k = k^ said each 
participant generates and sends B^ k ' l) = g^'^IV^ as said updated initial 
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value to said server device; and 

(b-5) if the result of decision in said step (b-3) is not k = k^, said each 
participant device generates and sends Bj- k ' l) = g^'^IVJ as said updated 
initial value to said server device; and 
5 said step (c) includes the steps wherein said server device: 

(c-1) for said updated initial value Hj 1 ^ received from said 
participant device having responded YES, generates 

H m = h K - km g(H m (k - 1) ) 

and for said updated initial value received from said each participant device 
10 having responded NO, generates 

H m = h K+1 - k g(H m (k " 1) ) 

(c-2) checks whether all of said H m are equal to said aimed value 
information H m (K) published on said bulletin board; and 

(c-3) if it is decided in said step (c-2) that they are equal, determines 
15 that said participant device having responded YES is the winning bidding 
device, and publishes the current value of said index k as the index k of the 
aimed value of said winning bidding device. 

19. The method of claim 1, wherein: there is provided a conversion 
table showing the relationships between a sequence of values selectable as 
20 said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto, and let the initial value of said each participant device 
be represented by IV m , where m = 1 , 2, . . . , M, M being an integer equal to or 
greater than 2; 

said step (a) is a step wherein said each participant device generates 
25 H m (K) = h K ~ km (g xm (IV m )) using a predetermined positive integer x m , said initial 
value IV m and one-way functions h and g, and sends said H m (K) as said aimed 
value information to said server device; 
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said step (b) includes the steps wherein: 

(b-1) said server device publishes said aimed value information H m (K) 
on a bulletin board accessible from all of said participant devices; 

(b-2) said server device sends said index k to said each participant 
5 device to ask for its updated initial value; 

(b-3) said each participant device decides whether its received index k 
is the index k,,, corresponding to said aimed value; 

(b-4) if the result of decision in step (b-3) is k = k^, said each 
participant device generates and H m (k_1) = g xm_1 (IV m ) as said updated initial 
10 value and sends it to said server device together with a flag indicating that 
said k and k m are equal; and 

(b-5) if the result of decision in said step (b-3) is not k = k^, said each 
participant device generates and sends H m (k " 1} = h^^g^IV^) as said 
updated initial value to said server device; 
15 said step (c) includes the steps wherein said server device: 

(c-1) checks whether its received updated initial value is added 

with said flag; 

(c-2) if it is decided in said step (c-1) that said flag is added, processes 
said updated initial value H m (k_1) with said one-way function g to generate 
20 gOf^); 

(c-3) decides whether said g(H m (k " 1} ) matches said aimed value 
information H m (K) ; 

(c-4) if it is decided in said step (c-1) that no flag is added, processes 
said updated initial value H m (k_1) with said one-way function h to generate 
25 h(Hj k - 1 >); 

(c-5) decides whether said h^/' 0 ) matches said aimed value 
information H m (K) ; 
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(c-6) if it is decided in said step that they are equal, updates said aimed 
value information Hj® with said initial value Hj^, then decrements said 
index k by one and return to said step (b-2); and 

(c-7) if it is decided in said step (c-5), processes said initial value Hj k ~ 
5 1} with said one-way function g to generate gCHj 1 "" 13 ) and returns to said step 
(c-3); and 

said step (d) is a step wherein if a match is detected in said step (c-3), 
decides that the aimed value of said participant device corresponding to m and 
k having provided said match is the maximum or minimum. 

10 20. A quantitative competition method for a system in which a 

plurality of participant devices send their secret aimed values to a server 
device and said server device determines which of said plurality of participant 
devices has offered the maximum or minimum one of said aimed values 
received, and in which there is provided a conversion table showing the 

1 5 relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, and m = 1 , 2, . . . , M, M being an integer equal to or greater than 2; 
said method comprising the steps wherein: 

(a) each of said participant devices processes, with a predetermined 
20 one-way function h and through the use of said conversion table, information 

k(+)b m (k) (+)R m (k) , which contains each index k equal to or larger than an index 
corresponding to said aimed value, select information b m (k) indicating 
whether said index k corresponds to said aimed value, and a random number 
Rj k \ to generate at least K-k^+1 pieces of aimed value information 
25 h(k(+)b m (k) (+)R m (k) ), and sends these pieces of aimed value information to said 
server device, A(+)B representing a predetermined arbitrary operation; 

(b) said server device publishes its received aimed value information 
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on a bulletin board accessible from all of said participant devices; 

(c) said server device obtains said random number corresponding 
to each of said sequence of indexes k; 

(d) letting a be a predetermined value with which said select 
5 information b m (k) indicates said aimed value, said server device calculates 

h(k(+)a(+)R m (k) ); 

(e) said server device checks said aimed values on said bulletin board 
for matching with said calculated h(k(+)a(+)R m (k) ); and 

(f) if a match is detected in said step (e), said server device decides 
10 that the aimed value of the aimed value information of a participant device 

having sent said random number R m (k) at that time is the maximum or 
minimum value. 

21. The method of claim 20, further comprising a step wherein if a 
match is detected in said step (d), said server device repeats said steps (c), (d) 

15 and (e) for the next value of said index k. 

22. The method of claim 21, wherein said step (c) includes the steps 
wherein: said server device requests said each participant device to send said 
random number Rj k) corresponding to said index k; said each participant 
device sends said requested random number Rj k) to said server device; and 

20 said server device receives said random number Rj k) . 

23. The method of claim 21, wherein: 

said step (a) includes a step wherein said each participant device sends 
said aimed value information h(k(+)b m (k) (+)R m (k) ) to said server device 
together with said random number Rj 10 ; 
25 said step (b) includes a step wherein said server device stores said 

random number R m (k) in a nonpublic memory; and 

said step (c) includes the steps wherein: said server device requests 
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said each participant device to send said random number R^ 10 corresponding 
to said index k; said each participant device sends said requested random 
number R ra (k) to said server device; and said server device receives said 
random number Rj 10 . 
5 24. The method of claim 4, 12, 15, 16, 17, 18, 19 or 20 wherein said 

sequences of indexes k and values selectable as said aimed values are both 
monotonous increasing values in the same direction, and in said step (c) said 
server device determines the maximum aimed value. 

25. The method of claim 4, 12, 15, 16, 17, 18, 19 or 20, wherein said 
10 sequences of indexes k and values selectable as said aimed values are both 

monotonous increasing values in opposite directions, and in said step (c) said 
server device determines the minimum aimed value. 

26. The method of claim 4, 12, 15, 16, 17, 18, 19 or 20, wherein let an 
arbitrary aimed value be represented by PR = F(k)+Q, where F(k) is a value in 

15 said conversion table corresponding to said index k and Q is a fraction which 
is a positive integer which satisfies F(k+l)-F(k)>Q>0; 

said step (a) includes a step wherein, letting said aimed value PR^ of 
said each participant device m be represented by PR^ = F(kJ + Q m , sa id eacn 
participant device m generates said aimed value information by processing 
20 said initial value with said one-way function h by the number of times 
corresponding to k^, sends said aimed value information to said server device 
together with said fraction Q m , where m = 1, 2, M, M being an integer 
equal to or greater than 2; 

said step (b) includes a step wherein said server device publishes said 
25 aimed value information and said fraction Q ra on a bulletin board accessible 
from all of said participant devices; 

said step (c) includes a step where said server device makes a check 
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for matching between said updated initial value and said aimed value 
information for each index value in an ascending or descending order of said 
fraction Q m where m = 1 , 2, . . . , M; and 

said step (d) includes a step wherein upon first detection of a match in 
5 said step (c), said server device finishes said check and determines, from 
and m at the time of detecting the match, that PE^ = F(k m )+Q m is said 
maximum or minimum aimed value. 

27. The method of claim 1, 4, 12, 15, 16, 17, 18, 19 or 20, further 
comprising the steps wherein: 

10 (0-1) said each participant device m sends its identifier ID m to a 

provisional identifier registration device; 

(0-2) said provisional identifier registration device issues a provisional 

identifier AID m for said identifier ID m , and stores said identifier ED m and said 

provisional identifier AID m in pair form in storage means; 
15 (0-3) said provisional identifier registration device sends said 

provisional identifier AID m to said each participant device; and 

(0-4) said each participant device m sends said provisional identifier 

ADD m as said identifier to said server device, together with said aimed value 

information. 

20 

28. A participant device for a system in which M participant devices 
send their aimed values to a server device and said server device determines 
which of said M participant devices has offered the maximum or minimum 
one of said aimed values received, said participant device comprising: 

25 aimed value generating means; 

aimed value transforming means which processes said aimed value 
with a predetermined one-way function by the number of times corresponding 
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to said aimed value to obtain aimed value information; and 

sending means for sending to said server device said aimed value 
information and an identifier specifying said participant device. 

29. The participant device of claim 28, wherein said aimed value 
5 transforming means comprises: 

a conversion table for converting said aimed value PI^ to the 
corresponding index k^; 

a one-way function h processor which processes an initial value IV m 
inherent to said participant device with a one-way function h by the number 
10 of times corresponding to said index 1^ to obtain an output h km (IV m ); and 

a one-way function g processor which processes said output from said 
one-way function h processor with a one-way function g to obtain said aimed 
value information. 

30. The participant device of claim 29, further comprising verification 
15 information generating means which generates C m = h K+1 (IV m ) as verification 

information by processing said initial value IV ra with said one-way function h 
K+l times and sends said verification information C m to said server device. 

31 . The participant device of claim 28, wherein said aimed value 
information transforming means comprises: 

20 a memory in which there is stored a conversion table which defines 

the relationships between a sequence of monotone varying values selectable 
as aimed values and a sequence of indexes, for converting said aimed value 
PRn, to the corresponding index 1^; 

a one-way function h processor which processes an initial value 
25 inherent to said participant device with a one-way function h by the number 
of time corresponding to said index 1^ and outputs h km (IV m ); and 

a one-way function g processor which processes the output from said 



one-way function h processor with a one-way function g to obtain said aimed 
value information. 

32. The participant device of claim 28, which further comprises: a 
random generator for generating a random number R^; an operating device 

5 for operating said random number and said aimed value PR^ to obtain 
PR m (+)R m ; one-way function h processing means for processing said 
PR m (+)R m with a one-way function h to obtain h(PR m (+)R m ); and verification 
information generating means for processing said initial value IV m with said 
one-way function h K+l times to generate C m = tP^IV^; and wherein said 
10 h(PR m (+)R m ) and said verification information are sent to said server device 
together with said aimed value information. 

33. The participant device of claim 28, wherein said aimed value 
transformer comprises: 

a conversion table memory which has stored therein a conversion table 
1 5 which defines indexes k = 1 , 2, . . . , K corresponding to K kinds of values 
selectable as aimed values; 

a select information generator which generates select information b m (k) 
indicating whether to select an aimed value corresponding to each of said 
indexes k = 1, 2, K; 
20 a random generator which generates a random number inherent 

to said participant device m and said index k; 

an operating device which receives said index k, said random number 
R Tn (k) and said select information b m (k) and performs an operation 
k(+)b m (k) (+)R m (k) ; 

25 a one-way function h processor which processes said k(+)b m (k) (+)R m (k) 

with a one-way function h to obtain h(k(+)b m (k) (+)R Tn (k) ); and 

a control device which computes said h(k(+)b m (k) (+)R m (k) ) for each of 
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said indexes k and provides the k pieces information as said aimed value 
information. 

34. The participant device of claim 28, wherein said aimed value 
transformer comprises: 

5 a conversion table memory which has stored therein a conversion table 

which defines indexes k = 1, 2, . . K corresponding to K kinds of values 
selectable as aimed values, for converting said aimed value PR^, to the 
corresponding index k,^; 

initial value updating means which, for each index k, processes an 
10 initial value with a one-way function h and adds the processed initial value 
with select information b m (k) for said index k to obtain an updated initial value 
and repeats this processing until k = K is reached, thereby generating Bj- K) ; 

select information generator which generates said select information 
b m (k) whether said aimed value corresponds to each index k from at least k^ to 
15 K; 

a one-way function h processor which processes said initial value with 
said one-way function h; 

a concatenator which concatenates said H m (k_1) and said select 
information to generate H m k = hCH^IIb^); 
20 a buffer which temporarily holds the output from said concatenator 

and outputs said output for the next value of said index k; and 

a storage part which, for each value of said index k, stores H m (k) 
corresponding thereto; and 

wherein said sending means is a means which responds to a request of 
25 said server device for said index k to read out H m (k) from said storage part and 
send said H m (k) to said server device. 

35. The participant device of claim 28, wherein said aimed value 
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transformer comprises: 

a conversion table memory which has stored therein a conversion table 
which defines indexes k = 1 , 2, . . . , K corresponding to K kinds of values 
selectable as aimed values, for converting said aimed value PR^ to the 
5 corresponding index k^; 

a one-way function g processor which processes said initial value IV m 
with a one-way function g by a predetermined number of times x m to generate 
g^IVJ; 

a one-way function h processor which processes said g^IV^ with a 
10 one-way function h K-l^ times to generate = ^"^(g^IVJ) as said 
aimed value information; and 

response generating means which responds to a request from said 
server device for k to decide whether k=k m , and if true, generates H^*"^ = h k ~ 
km - 1 (g xm (IV m )), and if false, generates Uj^ = g^CIVJ; and 
15 wherein said sending means sends said in response to said 

request from said server device for said k. 

36. The participant device of claim 28, wherein said aimed value 
transformer comprises: 

a conversion table memory which has stored therein a conversion table 
20 which defines the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto, for converting said aimed value PR^ to the 
corresponding index k^; 

a fraction calculating part which, letting an arbitrary aimed value PR 
25 be represented by PR = F(k)+Q, where F(k) is a value in said conversion table 
corresponding to said k and Q is a fraction which is a positive integer which 
satisfies F(k+l)-F(k)>Q>0, calculates said fraction Q m = PR m -F(k m ) based on 
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F(k m ) obtained from said conversion table and said aimed value PR^,; and 

a one-way function h processor which processes said initial value IV m 
with said one-way function h by the number of times corresponding to said 1^ 
to generate said aimed value information; and 
5 wherein said sending means sends said fraction Q m to said server 

device together with said aimed value information. 

37. A server device for a system in which M participant devices send 
their aimed values to said server device and said server device determines 
which of said M participant devices has offered the maximum or minimum 

10 one of said aimed values received, said device comprising: 

a conversion table memory which has stored therein a conversion table 
which defines the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
corresponding thereto, for converting said aimed value PR^ to the 
1 5 corresponding index lt^; 

a bulletin board on which said server device writes said aimed value 
information an identifier received from each of said participant devices; 

updated initial value generating means which generates an updated 
initial value by processing said initial value with a one-way function 
20 repeatedly in correspondence with values of an index k which is a 
predetermined consecutive positive integers; 

a counter which updates said index k one by one; and 
control means which, upon each updating of said index k, compares 
said updated initial value with said aimed value information on said bulletin 
25 board to check whether they match, and determines m and k at the time of 
first detection of a match. 

38. The server device of claim 37, wherein: there are published on said 
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bulletin board y m = g(h km (IV m )) as said aimed value information; 

said updated initial value generating means includes a one-way 
function g processor by which a response D m = h k (IV m ) received from said 
participant device in correspondence with said index k is processed with a 
5 one-way function g to generate g(D m ) as said updated initial value; and 

said control means makes a check to see if there exists on said 
bulleting board said aimed value information y m which matches said updated 
initial value g(D m ). 

39. The server device of claim 38, wherein there is published on said 
10 bulletin board C m = h K+1 (IV m ) received from said participant device in 

advance, said server device farther comprising a one-way function h 
processor which processes said response D m with a one-way function h to 
generate h(D m ), and 

wherein said control means checks whether C m = h(D m ) holds, and if 
15 not, rewrites said C m with said D m and updates said index k on said counter. 

40. The server device of claim 37, wherein: 

there are published on said bulletin board C m = h K+1 (IV m ), said aimed 
value information y m = h k (IV m ) and h(PR m (+)R m ) received from said each 
participant device, said PR m and said being an aimed value and a random 
20 number of said each participant device m; 

said control means decides the maximum or minimum aimed value 
from said aimed values PR^ and said random numbers received from said 
participant devices, and determines the index k mx corresponding to said 
maximum or minimum aimed value and requests said each participant device 
25 to send D m = h kmx (IV m ) corresponding to said index k^; 

said updated initial value generating means comprises a one-way 
function h processor for processing D m with a one-way function h to generate 
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jjK+i-kmxgj ^ a on e-way function g processor for processing D s with a one- 
way function g to generate g(Dj); and 

said control means makes a check to see if said h K+1 " kmx (D m ) matches 
C m on said bulletin board and if said g(Dj) matches said Y m on said bulleting 
board; 

41. The server device of claim 37, wherein: 

there are published on said bulletin board h(k(+)b m (k) (+)R m (k) ) together 
with said aimed value information y m received from said each participant 
device, said b m (k) being select information whether said index k corresponds to 
its aimed value and said R m (k) being a random number generated for said index 
k; 

said server device further comprises an operator for operating 
k(+)b(+)R m (k) , and a one-way function h processor for processing the result of 
said operation with a one-way function h to generate h(k(+)b(+)Rj k) ), where 
b is a predetermined value which indicates that said select information b m (k) 
has selected the aimed value corresponding to said index k; and 

said control means makes a check for matching between said 
h(k(+)b(+)R m (k) ) and said h(k(+)b m (k) (+)R m (k) ) on said bulletin board. 

42. The server device of claim 37, wherein: 

there is published on said bulletin board, as said aimed value 
information, H m (K) generated by said each participant device which, upon each 
processing of said initial value with a one-way function h, added the 
processed value with select information b m (k) indicating whether said value 
was an aimed value for each value of said index k and repeated this 
processing from at least the index k m corresponding to said aimed value to the 
upper limit value K of said index k; 

said updated initial value generating means includes a one-way 
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function h processor by which {FLj^K b m } received from said each 
participant device in answer to an inquiry for said index k is processed with a 
one-y function h to generate H m (k) = KHj^H b m (k) ); and 

said server device includes an updated initial value comparator for 
5 making a check to see if said H m {k) matches previously received Hj k) . 

43. The server device of claim 37, wherein: letting an arbitrary aimed 
value PR be represented by PR = F(k)+Q, where F(k) is a value in said 
conversion table corresponding to said index k and Q is a fraction which is a 
positive integer which satisfies F(k+l)-F(k)>Q>0, there is published on said 

10 bulletin board said fraction Q received from said each participant device, 
together with said aimed value information; 

said server device includes a sequencer for deciding the sequence of 
said fractions Q m on said bulletin board; 

said updated initial value generating means includes a one-way 
15 function h processor for processing said initial value with a one-way function 
h by k times to generate h k (IV m ) and a one-way function g processor for 
processing said h k (IV m ) with a one-way function g to generate D m = 
g(h k (IVJ); and 

control means makes a check to see if said D m matches said aimed 
20 value information on said bulletin board in the sequence of said fractions Q m . 

44. The server device of claim 37, wherein there is published on said 
bulletin board H m (K) = h^^Xg^IVJ) as said aimed value information 
received from said each participant device, which further comprises a one- 
way function h processor by which Hj kA) received from said each participant 

25 device as an answer to an inquiry for said k is processed with a one-way 
function h to generate h(H m (k " 1) ) s and a one-way function g processor for 
processing said answer H m (k l) with a one-way function g to generate g(Hj- k ~ 
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1} ); and 

wherein said control means: makes a check to see if said hCHj 1 "" 13 ) 
matches said aimed value information H m (K) published on said bulletin board; 
if a match is detected, updates said aimed value information ¥Lj K) with said 
H m (k_1) and decrements said index k on said counter by one; and if a mismatch 
is detected, makes a check to see if said g(Bj k - l) ) matches said aimed value 
information H ra (K) ; and if a match is detected, determines, based on k and m at 
that time, the maximum or minimum aimed value PR^ and the participant 
device m having offered said value PR^. 

45. The server device of claims 37, 38, 40, 41, 42, 43 or 44, wherein: 
letting an arbitrary aimed value PR be represented by PR = F(k)+Q, where 
F(k) is a value in said conversion table corresponding to said index k and Q is 
a fraction which is a positive integer which satisfies F(k+l)-F(k)>Q>0, there 
is published on said bulletin board said fraction Q received from said each 
participant device, together with said aimed value information; 
said server device includes: 

a sequencer for deciding the sequence of said fractions Q m on said 
bulletin board; and 

select information comparator for checking whether said select 
information b m (k) is equal to a value b indicating the selection of the aimed 
value corresponding to said index k in said decided sequence of fractions Q m . 

46. The device of claim 29, 31, 33, 34, 36, 37, 40, 41, 43 or 44, 
wherein said sequence of index values k and said sequence of values 
selectable as said aimed values on said conversion table are monotone 
increasing values in the same direction, and said server device determines the 
maximum aimed value. 

47. The device of claim 29, 31, 33, 34, 36, 37, 40, 41, 43 or 44, 
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wherein said sequence of index values k and said sequence of values 
selectable as said aimed values on said conversion table are monotone 
increasing values in opposite directions, and said server device determines the 
minimum aimed value. 

5 

48. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m = 1, 2, . . . , M, in a quantitative competition method for a system in which 
said M participant devices send their aimed values to a server device and said 

10 server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 
values respectively corresponding thereto, said procedure comprising the 

15 steps of: 

(a) processing an initial value inherent to said participant device m 
with a predetermined one-way function by the number of times corresponding 
to said aimed value to generate aimed value information 

y m = g(h km (iv m )) 

20 where g is a one-way function, IV m is said initial value, k^ is an index 

corresponding to the aimed value of said participant device m and h km (IV m ) 
indicates processing of said initial value IV m with a one-way function h by k^ 
times; and 

(b) sending said aimed value information y m = g(h km (IV m )) to said 
25 server device. 

49. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
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m = 1, 2, . . . , M, in a quantitative competition method for a system in which 
said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
5 provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 
values respectively corresponding thereto, said procedure comprising the 
steps of: 

(a-1) processing an initial value inherent to said participant device m 
10 with a predetermined one-way function by the number of times corresponding 
to said aimed value to generate aimed value information 
Y m = g(h km (IV m )) 

where g is a one-way function, IV m is said initial value, is an index 
corresponding to the aimed value of said participant device m and h km (IV m ) 
15 indicates processing of said initial value IV m with a one-way function h by 1^ 
times; 

(a-2) generating verification information C m = h K+1 (IV m ) and sending 
said verification information to said server device together with said aimed 
value information y m ; 
20 (b) generating said initial value updated by the number of times 

requested by said server device and sending said updated initial value to said 
server device; and 

(c) sending said aimed value information y m = g(h km (IV m )) to said 
server device. 

25 50. The recording medium of claim 49, wherein said step (b) includes 

a step of generating D m = h k (IV m ) as said updated initial value corresponding 
to said index k and sending said updated initial value to said server device in 
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response to its request. 

51 . A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m = 1 , 2, . . . , M, in a quantitative competition method for a system in which 
5 said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 
10 values respectively corresponding thereto, said procedure comprising the 
steps of: 

(a-1) computing aimed value information by 
Y m = g(h km (IV m )) 

where g is a one-way function, IV m is said initial value, is an index 
1 5 corresponding to the aimed value PR^ of said participant device m and 
h^IV^ indicates processing of said initial value IV m with a one-way 
function h by times; 

(a-2) generating verification information C m = h K+1 (IV m ); 
(a-3) generating h(PR m (+)R m ) from a random number R^ and said 
20 aimed value PR m and sending said h(PR m (+)R m ) to said server device together 
with said aimed value information y m and said verification information C m , 
said (+) indicating a predetermined arbitrary operation; 

(b-1) sending said aimed value PR m and said random number R^ to 
said server device in response to its request; and 
25 (b-2) generating D m = h k (IV m ) as said updated initial value 

corresponding to said index k and sending said updated initial value to said 
server device in response to its request to present said h k (IV m ). 
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52. The recording medium of claim 51, wherein said step (a-3) is a 
step of generating h(PR m (+)R m ) from a random number R m , said aimed value 
PR,,, and additional information I m about the sending of said aimed value 
information indicated by said participant device m and sending said 
5 h(PR tn (+)R m ) to said server device, said additional information I m being sent 
to said server device in said step (b-2). 

53.. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m = 1, 2, . . . , M, in a quantitative competition method for a system in which 

10 said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 

1 5 values respectively corresponding thereto, said procedure comprising the 
steps wherein: 

(a) upon each processing of said initial value with said one-way 
function h, said each participant device generates an updated initial value by 
adding said processed initial value with select information b m (fc) indicating 

20 whether said processed initial value is an aimed value for one value of said 
index k, and generates H m (K) by repeatedly performing this processing from at 
least that index of a sequence of indexes which corresponds to said aimed 
value to the upper limit value K, and sends said Hj^ as said aimed value 
information to said server device; 

25 (b-1) said server device requests said each participant device to send 

an updated initial value {H m (k_1) , b m (k) } corresponding to each value of said 
index k in descending order from K; and 
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(b-2) said each participant device generates and sends {Hj^K b m (k) } 
as said updated initial value to said server device. 

54. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m = 1 , 2, ...,M, ina quantitative competition method for a system in which 
said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 
values respectively corresponding thereto, said procedure comprising the 
steps of: 

(a) generating H m (K) = h^^g^IVJ) as said aimed value information 
using a predetermined positive integer x m , an initial value IV m and one-way 
functions h and g, and sends said aimed value information to said server 
device; 

(b-1) decides whether its received index k from said server device is 
the index k m corresponding to said aimed value; 

(b-2) if the result of decision in step (b-1) is k = generating and 
sending H m (k " 1} = g^CIV J as said updated initial value to said server device; 
and 

(b-3) if the result of decision in said step (b-1) is not k = k^, 
generating and sending Hj kA) = h^-^g^IVJ) as said updated initial value 
to said server device. 

55. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m = 1 , 2, . . . , M, in a quantitative competition method for a system in which 
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said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
provided a conversion table showing the relationships between a sequence of 
5 values selectable as said aimed values and a sequence of indexes k of integral 
values respectively corresponding thereto, letting the initial value of said each 
participant device be represented by IV m , said procedure comprising the steps 
of: 

(a) generating H m (K) = h^^g^IVJ) as said aimed value information 
10 using a predetermined positive integer x m , an initial value IV m and one-way 
functions h and g, and sends said aimed value information to said server 
device; 

(b-1) decides whether its received index k from said server device is 
the index corresponding to said aimed value; 
1 5 (b-2) if the result of decision in step (b-1) is k = generating 

= g^CIVJ as said updated initial value and sending said updated initial 
value to said server device together with a flag indicating that said k and k,,, 
are equal; and 

(b-3) if the result of decision in said step (b-1) is not k = k^ 
20 generating and sending = h^KfTQVJ) as said updated initial value 

to said server device. 

56. A recording medium on which there is recorded as a program the 
procedure which is followed by an m-th one of M participant devices, where 
m - 1, 2, . . . , M, in a quantitative competition method for a system in which 
25 said M participant devices send their aimed values to a server device and said 
server device determines which of said M participant devices has offered the 
maximum or minimum one of said aimed values received, and there is 
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provided a conversion table showing the relationships between a sequence of 
values selectable as said aimed values and a sequence of indexes k of integral 
values respectively corresponding thereto, said procedure comprising the step 
of: 

5 (a) processing, with a predetermined one-way function h and through 

the use of said conversion table, information k(+)b m (k) (+)R m (k) , which contains 
each index k equal to or larger than an index 1^ corresponding to said aimed 
value, select information b m (k) indicating whether said index k corresponds to 
said aimed value, and a random number Rj k \ to generate at least K-k m +l 
10 pieces of aimed value information h(k(+)b m (k) (+)R m (k) ), and sends these pieces 
of aimed value information to said server device, A(+)B representing a 
predetermined arbitrary operation. 

57. The recording medium of claim 56, wherein said procedure further 
comprises a step of sending to said server device a random number Rj® 

1 5 corresponding to the index k received from said server device. 

58. The recording medium of claim 56, wherein said step (a) includes 
a step of sending a random number Rj k) to said server device together with 
said h(k(+)b m (k) (+)R m (k) ). 

59. The recording medium of claim 49, 51, 53, 54, 55 or 56, wherein 
20 let an arbitrary aimed value be represented by PR = F(k)+Q, where F(k) is a 

value in said conversion table corresponding to said index k and Q is a 
fraction which is a positive integer which satisfies F(k+l)-F(k)>Q>0; 

said procedure further comprises a step wherein, letting said aimed 
value PR m of said each participant device m be represented by PR m = 
25 F(k m )+Q m , said each participant device m sends said fraction Q m to said server 
device together with said aimed value information y m . 

60. The recording medium of claim 49, 51, 53, 54, 55 or 56, wherein 
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said sequences of indexes k and values selectable as said aimed values are 
both monotonous increasing values in the same direction. 

61. The recording medium of claim 49, 51, 53, 54, 55 or 56, wherein 
said sequences of indexes k and values selectable as said aimed values are 

5 both monotonous increasing values in opposite directions. 

62. The recording medium of claim 49, 51, 53, 54, 55 or 56, wherein 
said procedure further comprises the steps of: 

(0-1) sending the identifier ED m of said each participant device to a 
provisional identifier registration device; 
10 (0-2) receiving a provisional identifier AED m from said provisional 

identifier registration device; and 

(0-3) sending said provisional identifier ATJD m as an identifier to said 
server device together with said aimed value information. 

15 63. A recording medium on which there is recorded as a program the 

procedure which is followed by a server device in a quantitative competition 
method for a system in which a plurality of participant devices send their 
aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 

20 aimed values received, and there is provided a conversion table showing the 
relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) publishing aimed value information y m = g(h km (IVJ) received from 

25 said each participant device on a bulletin board accessible from all of said 
participant device, g being a one-way function, IV m being said initial value, 
being an index corresponding to the aimed value of said each participant 
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device m and h^IVJ indicating processing of said initial value IV m with a 
one-way function h by k m times; 

(b) generating an updated initial value by D m = g(h k (IV m )); 

(c) checking whether there is any aimed value information y m which is 
5 equal to said updated initial value D m ; and 

(d) upon first detection of a match in said step (c), deciding that the 
aimed value of the participant device corresponding to said updated initial 
value D m which matches said aimed value information y m . 

64. The recording medium of claim 63, wherein said step (a) includes 
10 a step of publishing verification information C m = h K+1 (IV m ) received from 

said each participant device on said bulletin board together with said aimed 
value information y m . 

65. The recording medium of claim 64, wherein: said step (b) includes 
the steps of: 

15 (b-1) requesting said each participant device to send D m = h k (IV m ) 

corresponding to said index k; and 

(b-2) receiving from said each participant device D m = h k (IV m ) as said 
updated initial value corresponding to said index k; and 

said step (c) includes a step of generating g(D m ) and making a check 
20 for said aimed value information y m = g(D m ). 

66. The recording medium of claim 65, wherein: 

said step (b) includes a step (b-0) of setting said index k to an upper 
limit value K; and 

said step (c) includes the steps of: 
25 (c-1) publishing said D m = h k (IV m ) received from said each participant 

device on said bulletin board; 

(c-2) computing said g(D m ) for said each participant device m; 



84 

(c-3) making a check to see if said g(D m ) matches said aimed value 
information; 

(c-4) if no match is detect for any of said m in said step (c-3), 
replacing said D m with said C m , decrementing said index k by one and 
5 returning to said step (b-1); and 

(c-5) if a match is detected in said step (c-3), determining that the 
value corresponding to said index k at that time is said maximum or minimum 
aimed value. 

67. The recording medium of claim 66, wherein said step (c-1) 

1 0 includes a step of generating h(D m ) and making a check to see if h(D m ) = C m 
holds. 

68. The recording medium of claim 66, wherein said procedure 
includes a step of publishing said determined maximum or minimum aimed 
value and said h km (IV m ) on said bulletin board. 

15 69. The recording medium of claim 63, wherein: 

said step (b) includes the steps of 
(b-0) setting said index k to an upper limit value K; 
(b-1) inquiring said each participant device m about whether said 
aimed value information corresponds to said index; 
20 (b-2) checking whether an answer from said each participant device 

acknowledges said correspondence; 

(b-3) if said answer from said each participant device denies said 
correspondence, decrementing said k by one and returning to said step (b-1); 
(b-4) if said answer from said each participant device acknowledges 
25 said correspondence, requesting said each participant device to present an 
updated initial value h k (IV ra ); 

(b-5) publishing D m = h k (IV m ) from said each participant device on 
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said bulletin board; and 

said step (c) includes the steps of: 

(c-1) generating h(D m )'s for all of said D m 's; 

(c-2) checking whether said h(D m )'s match said verification 
5 information C m 's on said bulletin board, respectively; 

(c-3) if no mismatch is detected in said step (c-1), generating g(Dj) for 
Dj presented by a participant device j having bid; 

(c-4) checking whether said g(Dj) matches said aimed value 
information y- of said participant device j on said bulletin board; and 
10 (c-5) if said g(Dj) matches said y y in said step (c-4), decides that said 

participant device j sent to said server device said aimed value information 
corresponding to said aimed value k. 

70. The recording medium of claim 63, wherein: 

said step (b) includes the steps of: 
15 (b-1) publishing its received y m , h(PR m (+)R Tn ) and ID m on said bulletin 

board, said (+) indicating a predetermined arbitrary operation; 

(b-2) requesting said each participant device to present its aimed value 
PR^ and random number K^; 

(b-3) determining from its received PR^ and an index k 
20 corresponding to the maximum one of said aimed values and a participant 

device j having sent said aimed value information corresponding to said index 
k; 

(b-4) requesting all of said participant devices to present h k (IV m ); and 
(b-5) receiving D m =h k (IV m ) as said updated initial value from said 
25 each participant device; 

said step (c) includes the steps of: 

(c-1) publishing all of its received D m 's on said bulletin board; 



86 



(c-2) generating h(DJ's for all of said D m 's; 

(c-3) checking whether said h(D m )'s match said verification 
information C m 's on said bulletin board, respectively; 

(c-4) if no mismatch is detected in said step (c-3), generating g(Dj) for 
5 Dj presented by said participant device j having sent said maximum aimed 
value determined in said step (b-4); and 

(c-5) checking whether said g(Dj) matches said aimed value 
information yj of said participant device j on said bulletin board; and 

said step (d) includes a step of deciding that said participant device j 
10 sent said aimed value information for said aimed value k, if a match is 
detected in said step (c-5). 

71. The recording medium of claim 70, wherein said step (d) includes 
the steps of: 

(d-1) generating E m = g(h l - k (h k (IV J) for t such that k<t<K and for all 
15 of said m's except said j; 

(d-2) checking whether these E m 's match said aimed value information 
y m on said bulletin board; and 

(d-3) if no match is detected in said step (d-2), deciding that said k is 
an index corresponding to the maximum or minimum aimed value, and 
20 outputting said k and said identifier ID m of said participant device j having 
presented said aimed value. 

72. The recording medium of claim 70 or 71, wherein 

said step (b-2) includes a step of requesting all of said participant 
devices to present additional information I m as well as said aimed value PR^ 
25 and said random number 

73. A recording medium on which there is recorded as a program the 
procedure which is followed by a server device in a quantitative competition 
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method for a system in which a plurality of participant devices send their 
aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
aimed values received, and there is provided a conversion table showing the 
5 relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) receiving, from each of participant devices, h(H m (K) ) generated as 
aimed value information of said each participant device by repeating, for each 
10 of a sequence of index values k from at least corresponding to an aimed 
value of said each participant device to an upper limit index value K, 
processing of: 

combining an initial value of said each participant device with select 
information to provide combined information and 
15 operating a one-way function h on said combined information to 

generate an updated value, said select information indicating whether said 
each index value k is an aimed value or not, and 

publishing said aimed value information h(Hj Ky ) on a bulletin board 
accessible from all of said participant devices and any other devices as well; 
20 (b) requesting said each participant device to send an updated initial 

value {H m (k_1) , b m (k) } corresponding to each value of said index k in 
descending order from K; 

(c) publishing said updated initial value {E^/ 1 ^, b m (k) } on said bulletin 

board; 

25 (d) processing said updated initial value {H^*' 11 , b m (k) } with said one- 

way function h to generate 1^^= hCH^Hb^); 

(e) checking whether said updated initial value H m (k) matches H m (k) in 
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{H m (k) , b m (k+1) } received previously; and 

(f) if a match is detected in said step (e), deciding whether said select 
information b m (k) represents that the corresponding index k is the index of 
said aimed value; and 
5 (g) if the result of decision in said step (f) is true, outputting said index 

k concerned and the corresponding participant device number m, and if the 
result of decision is false, said server device returns to said step (b) and 
repeats processing for the next index value k. 

74. A recording medium on which there is recorded as a program the 

10 procedure which is followed by a server device in a quantitative competition 
method for a system in which a plurality of participant devices send their 
aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
aimed values received, and there is provided a conversion table showing the 

15 relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps wherein said server device: 

(a) receives H m (K) as said aimed value information from said each 
participant device which, upon each processing of said initial value with said 

20 one-way function h, generates an updated initial value by adding said 

processed initial value with select information b m (k) indicating whether said 
processed initial value is an aimed value for one value of said index k, and 
generates Bj- K) by repeatedly performing this processing from at least that 
index k^ of a sequence of indexes which corresponds to said aimed value to 

25 the upper limit value K, and publishes said aimed value information Hj K) on 
a bulletin board accessible from all of said participant device; 

(b) for each value of said index k in order descending from K, inquires 
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said each participant device about whether it has bid for said index k, said 
each participant device responding YES or NO to said inquiry; 

(c) upon first detection of the response YES, requests said each 
participant device to send its updated initial value Hj*" 1 *; and 
5 (d) receives = h(H m (k_2) || b m {k ' 1} ) as said updated initial value from 

said each participant device and publishes said received updated initial value 
on said bulletin board; 

(e) letting a and a represent predetermined values of said select 
information b m (k) indicating bidding and not bidding, respectively, generates, 

1 0 for said participant device m having bid for the current index k, 
H m = h(...h(h(H m ^ 1 >||a)!|a)...l|a) 
through the use of said updated initial value H^" 0 , and for every one of the 
other participant devices m, generates 

H m = h(...h(h(H m ^||a)||a)...||a) 
1 5 through the use of said updated initial values H^" 15 ; 

(f) checks whether said H m for said each participant device matches 
said H m (k) published on said bulletin board; and 

(g) if a match is detected in said step (f), determines that said 
participant device having responded YES is the winning bidding device, and 

20 publishes the current value of said index k as the index 1^ of the aimed value 
of said winning bidding device. 

75. A recording medium on which there is recorded as a program the 
procedure which is followed by a server device in a quantitative competition 
method for a system in which a plurality of participant devices send their 

25 aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
aimed values received, and there is provided a conversion table showing the 
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relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) letting the initial value of said each participant device be 
represented by IV m , receiving from said each participant device H m (K) = h K " 
^(g^XIVJ) generated as said aimed value information using a predetermined 
positive integer x m , said initial value IV m and one-way functions h and g; 

(b) publishing said aimed value information on a bulletin board 
accessible from all of said participant devices; and 

(c) sending said index k to said each participant device to ask for its 
updated initial value; 

(d) processing said updated initial value H m (k4) with said one-way 
function h to generate hCHj 1 ^); 

(e) deciding whether said h(H m (k " 1) ) is equal to said aimed value 
information H m (K) ; 

(f) if it is decided in said step (e) that they are equal, updating said 
aimed value information H m (K) with said updated initial value Hj- k ~ l) , then 
decrementing said index k by one and returning to said step (c); 

(g) if it is decided in said step (e) that they are not equal, processing 
said updated initial value H m (k " l) with said one-way function g to generate 
gCHj^); and 

(h) deciding whether said gCHj 1 ^) matches said aimed value 
information H m (K) ; and 

(i) deciding that the aimed value of said participant device 
corresponding to m and k having provided said match is the maximum or 
minimum, if a match is detected in said step (h). 

76. A recording medium on which there is recorded as a program the 



91 



procedure which is followed by a server device in a quantitative competition 
method for a system in which a plurality of participant devices send their 
aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
5 aimed values received, and there is provided a conversion table showing the 
relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps wherein said server device: 

(a) , letting the initial value of said each participant device be 

10 represented by IV m , where m = 1,2, . . . , M, M being an integer equal to or 
greater than 2, receives from each participant device, as said aimed value 
information, = h^^g^IVjJ) using a predetermined positive integer x m , 
said initial value IV m and one-way functions h and g, and publishes said 
received aimed value information on a bulletin board accessible from all of 

15 said participant devices; 

(b) for each value of said index k in order descending from K, inquires 
said each participant device about whether it has bid for said index k, said 
each participant device responding YES or NO to said inquiry; 

(c) upon first detection of the response YES, requests said each 
20 participant device to send its updated initial value H^" 1 *; 

(d) receives from said each participant device = g^'^IVJ if k = 
^ and H m (k4) = h^Cg^flVJ) if k * 1^; 

(e) for said updated initial value Hj 1 "" 0 received from said participant 
device having responded YES, generates 

25 H m = h^gCHj 1 ^) 

and for said updated initial value received from said each participant device 
having responded NO, generates 
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H m = h K+1 - k g(H m ^) 

(f) checks whether said H m for said each participant device matches 
said Hj K) published on said bulletin board; and 

(g) if a match is detected in said step (f), determines that said 

5 participant device having responded YES is the winning bidding device, and 
publishes the current value of said index k as the index K m of the aimed value 
of said winning bidding device. 

77. A recording medium on which there is recorded as a program the 
procedure which is followed by a server device in a quantitative competition 

10 method for a system in which a plurality of participant devices send their 

aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
aimed values received, and there is provided a conversion table showing the 
relationships between a sequence of values selectable as said aimed values 

1 5 and a sequence of indexes k of integral values respectively corresponding 
thereto, said procedure comprising the steps of: 

(a) letting the initial value of said each participant device be 
represented by IV m , receiving from said each participant device H m (K) = h K ~ 
km (g xm (IV m )) generated as said aimed value information using a predetermined 

20 positive integer x m , said initial value IV m and one-way functions h and g; 

(b) publishing said aimed value information Hj™ on a bulletin board 
accessible from all of said participant devices; and 

(c) sending said index k to said each participant device to ask for its 
updated initial value; 

25 (d) checking whether its received updated initial value H tm is added 

with said flag; 

(e) if it is decided in said step (d) that said flag is added, processing 
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said updated initial value H m (k_I) with said one-way function g to generate 

g(H» <k -"); 

(f) deciding whether said g(H m (k " !) ) matches said aimed value 
information H m (K) ; 

5 (g) if it is decided in said step (d) that no flag is added, processing said 

updated initial value Hj kA) with said one-way function h to generate KH^" 

"); 

(h) deciding whether said hCHj 1 ^) matches said aimed value 
information H m (K) ; 

10 (i) if it is decided in said step that they are equal, updating said aimed 

value information Hj^ with said initial value H^"^, then decrementing said 
index k by one and returning to said step (c); and 

(j) if it is decided in said step (h), processing said initial value Hj*' 1 * 
with said one-way function g to generate g^ 1 '' 1 ^ and returning to said step 

15 (f);and 

(k) if a match is detected in said step (f), deciding that the aimed value 
of said participant device corresponding to m and k having provided said 
match is the maximum or minimum. 

78. A recording medium on which there is recorded as a program the 

20 procedure which is followed by a server device in a quantitative competition 
method for a system in which a plurality of participant devices send their 
aimed values to said server device and said server device determines which of 
said participant devices has offered the maximum or minimum one of said 
aimed values received, and there is provided a conversion table showing the 

25 relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes k of integral values respectively corresponding 
thereto, and m = 1, 2, . . . , M, M being an integer equal to or greater than 2; 
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said procedure comprising the steps of: 

(a) receiving from each of said participant devices at least K-k^+1 
pieces of aimed value information h(k(+)b in (k) (+)R m (k) ) generated by 
processing, with a predetermined one-way function h and through the use of 
5 said conversion table, information k(+)b m (k) (+)R m (k) , which contains each 
index k equal to or larger than an index corresponding to said aimed value, 
select information b m (k) indicating whether said index k corresponds to said 
aimed value, and a random number R m (k) , A(+)B representing a predetermined 
arbitrary operation between A and B; 
10 (b) receiving and publishing said aimed value information on a 

bulletin board accessible from all of said participant devices; 

(c) obtaining said random number corresponding to each of said 
sequence of indexes k; 

(d) calculating h(k(+)a(+)R m (k) ), where a is a predetermined value with 
1 5 which said select information b m (k) indicates said aimed value; 

(e) checking said aimed values on said bulletin board for matching 
with said calculated h(k(+)a(+)R m (k) ); and 

(f) if a match is detected in said step (e), deciding that the aimed value 
of the aimed value information of a participant device having sent said 

20 random number Rj-® at that time is the maximum or minimum value. 

79. The recording medium of claim 78, wherein said procedure further 
comprises a step of repeating said steps (c), (d) and (e) if a match is detected 
in said step (d). 

80. The recording medium of claim 79, wherein said step (c) includes 
25 the steps of: requesting said each participant device to send said random 

number Rj 10 corresponding to said index k; and receiving said random 
number Rj- 10 from said each participant device. 
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81. The recording medium of claim 79, wherein: 

said step (a) includes a step of receiving said random number R m (k) 
sent from said each participant device together with said aimed value 
information h(k(+)b m (k) (+)R m (k) ); 
5 said step (b) includes a step of storing said random number R m (k) in a 

nonpublic memory; and 

said step (c) includes the steps of: requesting said each participant 
device to send said random number Rj 10 corresponding to said index k; and 
receiving said random number Rj k) from said each participant device. 
10 82. The recording medium of claim 63, 64, 69, 70, 73, 74, 75, 76, 77 

or 78, wherein said sequences of indexes k and values selectable as said 
aimed values are both monotonous increasing values in the same direction, 
and in said step (c) said server device determines the maximum aimed value. 

83. The recording medium of claim 63, 64, 69, 70, 73, 74, 75, 76, 77 
15 or 78, wherein said sequences of indexes k and values selectable as said 

aimed values are both monotonous increasing values in opposite directions, 
and in said step (c) said server device determines the minimum aimed value. 

84. The recording medium of claim 63, 64, 69, 70, 73, 74, 75, 76, 77 
or 78, wherein let an arbitrary aimed value be represented by PR = F(k)+Q, 

20 where F(k) is a value in said conversion table corresponding to said index k 
and Q is a fraction which is a positive integer which satisfies F(k+1)- 
F(k)>Q>0; 

said step (a) includes a step wherein, letting said aimed value PR m of 
said each participant device m be represented by PR^ = F(k m )+Q m , said server 
25 device receives from each participant device m said aimed value information 
generated by processing said initial value with said one-way function h by the 
number of times corresponding to k m , together with said fraction Q m , where m 
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= 1, 2, M, said M being an integer equal to or greater than 2, and said 
server device publishes said aimed value information and said fraction Q m on 
a bulletin board accessible from all of said participant devices; 

said step (c) includes a step where said server device makes a check 
5 for matching between said updated initial value and said aimed value 
information for each index value in an ascending or descending order of said 
fraction Q m where m = 1, 2, . . . , M; and 

said step (d) includes a step wherein, upon first detection of a match in 
said step (c), said server device finishes said check and determines, from 
10 and m at the time of detecting the match, that PR m = F(k m )+Q m is said 
maximum or minimum aimed value. 

85. The recording medium of claim 78 or 79, wherein let an arbitrary 
aimed value be represented by PR = F(k)+Q, where F(k) is a value in said 
conversion table corresponding to said index k and Q is a fraction which is a 
1 5 positive integer which satisfies F(k+l)-F(k)>Q>0; 

said step (a) includes a step wherein, letting said aimed value PR m of 
said each participant device m be represented by PPv^ = F(k m )+Q m , said server 
device receives said fraction Q m together with said aimed value information; 
said step (b) includes a step of publishing said fraction Q m on said 
20 bulletin board together with said aimed value information, where m = 1, 2, . . . , 
M, said M being an integer equal to or greater than 2; 

said step (e) includes a step of making said check for matching for 
each index value in an ascending or descending order of said fraction Q m 
where m = 1 , 2, . . . , M; and 
25 said step (f) includes a step wherein, upon first detection of a match in 

said step (c), said server device finishes said check and determines, from 
and m at the time of detecting the match, that PRn, = F(k m )+Q m is said 
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maximum or minimum aimed value. 

86. A quantitative competition system which comprises a server 
device and M participant devices each connected via a communication 
channel to said server device and in which said M participant devices send 
their aimed values to said server device and said server device determines 
which of said M participant devices has offered the maximum or minimum 
one of said aimed values received, 

each of said participant devices comprising: 
aimed value generating means for generating an aimed value PR^; 
aimed value transforming means provided with a conversion table 
memory having stored therein a conversion table which defines the 
relationships between a sequence of values selectable as said aimed values 
and a sequence of indexes corresponding thereto, for converting said aimed 
value PR m to the corresponding index 1^ and which processes said aimed 
value with a predetermined one-way function by the number of times 
corresponding to said aimed value to obtain aimed value information; and 

sending means for sending to said server device said aimed value 
information and an identifier identifying said participant device; and 
said server device comprising: 

a conversion table memory which has stored therein a conversion table 
which is the same as said conversion table; 

a bulletin board on which said server device writes said aimed value 
information an identifier received from said each participant device; 

updated initial value acquiring means which acquires an updated 
initial value obtained by processing said initial value with a one-way function 
repeatedly in correspondence with values of an index k which is a 
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predetermined consecutive positive integers; 

a counter which updates said index k one by one; and 

control means which, upon each updating of said index k 5 compares 

said updated initial value with said aimed value information on said bulletin 
5 board to check whether they match, and determines m and k at the time of 

first detection of a match. 

87. The system of claim 86, wherein said each participant device has 
initial value updating means for processing said initial value with a oneOway 
function h to generate an updated initial value and for sending said updated 

10 initial value to said server device, and said updated initial value acquiring 
means of said server device receives said updated initial value from said each 
participant device. 

88. The system of claim 86, wherein said updated initial value 
acquiring means of said server device processes said initial value with a one- 

1 5 way function h to generate said updated initial value. 

89. The system of claim 87 or 88, wherein said aimed value 
transformer of said each participant device comprises: 

a one-way function h processor which processes an initial value IV m 
inherent to said participant device with a one-way function h by the number 
20 of times corresponding to said index k m to obtain an output h km (IV m ); and 

a one-way function g processor which processes said output from said 
one-way function h processor with a one-way function g to obtain said aimed 
value information. 

90. The system of claim 89, wherein said aimed value transformer of 
25 said each participant device includes verification information generating 

means for processing said initial value IV m with said one-way function h by 
K+l times to generate C m = h^^IVjJ as verification information and for 
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sending said verification information to said server device; 

wherein there is published on said bulletin board C m = h K+1 (IV m ) 
received from said each participant device in advance, said server device 
further comprising a one-way function h processor which processes said 
5 response D m with a one-way function h to generate h(D m ), and 

wherein said control means checks whether C m = h(D m ) holds, and if 
not, rewrites said C m with said D m and updates said index k on said counter. 

91. The system of claim 86, wherein said each participant device 
comprises: 

10 a random generator for generating a random number R ffl ; 

an operating device for operating said random number K m and said 
aimed value PR m to obtain PR m (+)R m , where (+) represents a predetermined 
arbitrary operation; 

one-way function h processing means for processing said PR m (4-)R m 
15 with a one-way function h to obtain h(PR m (+)R m ); and 

verification information generating means for processing said initial 
value IV m with said one-way function h K+l times to generate C m = 
h K+1 (IVJ; and wherein: 

said h(PR m (+)R m ) and said verification information are sent to said 
20 server device together with said aimed value information; 
in said server device: 

there are published on said bulletin board C m = h K+1 (IV m ), said aimed 
value information y m = h k (IV m ) and h(PR m (+)R m ) received from said each 
participant device, said PR m and said ^ being an aimed value and a random 
25 number of said each participant device m; 

said control means decides the maximum or minimum aimed value 
from said aimed values PR^ and said random numbers R m received from said 
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participant devices, and determines the index k^ corresponding to said 
maximum or minimum aimed value and requests said each participant device 
to send (D m ) = h kmx (IV m ) corresponding to said index k^; 

said updated initial value acquiring means comprises a one-way 
5 function h processor for processing D m with a one-way function h to generate 
jjK+i-kmx^p^^ an( j a one _ wa y function g processor for processing Dj with a one- 
way function g to generate g(Dj); and 

said control means makes a check to see if said h K+l " kmx (D ra ) matches 
C m on said bulletin board and if said g(Dj) matches said y m on said bulleting 
10 board. 

92. The system of claim 86, wherein said aimed value transformer of 
said each participant device comprises: 

a conversion table memory which has stored therein a conversion table 
which defines indexes k = 1, 2, . . . , K corresponding to K kinds of values 
15 selectable as aimed values; 

a select information generator which generates select information b m (k) 
indicating whether to select an aimed value corresponding to each of said 
indexes k = 1, 2, K; 

a random generator which generates a random number Rj k) inherent 
20 to said participant device m and said index k; 

an operating device which receives said index k, said random number 
and said select information b m (k) and performs an operation 
k(+)b m (k) (+)R m (k) ; 

a one-way function h processor which processes said k(+)b m (k) (+)R ra (k) 
25 with a one-way function h to obtain h(k(+)b m (k) (+)R m ( k ^); and 

a control device which computes said h(k(+)b m (k) (+)R m (k) ) for each of 
said indexes k and provides the k pieces information as said aimed value 
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information; 

in said server device: 

there are published on said bulletin board h(k(+)b m (k) (+)R m (k) ) together 
with said aimed value information y m received from said each participant 
5 device; 

said server device further comprises an operator for operating 
k(+)b(+)R m (k) , and 

a one-way function h processor for processing the result of said 
operation with a one-way function h to generate h(k(+)b(+)R m (k) ), where b is a 
10 predetermined value which indicates that said select information b m (k) has 
selected the aimed value corresponding to said index k; and 

said control means makes a check for matching between said 
h(k(+)b(+)R m (k) ) and said h(k(+)b m (k) (+)R m (k) ) on said bulletin board. 

93 . The system of claim 86, wherein said aimed value transformer of 
15 said each participant device comprises: 

a conversion table memory which has stored therein a conversion table 
which defines indexes k = 1,2, . . . , K corresponding to K kinds of values 
selectable as aimed values, for converting said aimed value PR^ to the 
corresponding index k^; 
20 initial value updating means which, for each index k, processes an 

initial value with a one-way function h and adds the processed initial value 
with select information b m (k) for said index k to obtain an updated initial value 
and repeats this processing until k = K is reached, thereby generating Hj- K) ; 

a one-way function h processor for outputting said updated initial 
25 value H m (k) from said initial value updating means as said aimed value 
information; 

select information generator which generates said select information 
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b m (k) whether said aimed value corresponds to each index k from at least to 
K; 

a concatenator which concatenates said H m (k " 1) from said one-way 
function h processor and said select information b m (k) to generate H m k = KHj 1 "" 

a buffer which temporarily holds the output from said concatenator 
and outputs said output for the next value of said index k; 

a storage part which, for each value of said index k, stores H m (k) 
corresponding thereto; and 
10 a second one-way function h processor by which H m (k) , obtained by 

repeating processing until k = K, is processed with a one-way function h to 
generate h(H m (k) ), said h(H m (k) ) being output as said aimed value information; 

wherein said sending means is a means which responds to a request of 
said server device for said index k to read out H m (k) from said storage part and 
1 5 send said H m (k) to said server device; 

in said server device: 

there are published on said bulletin board, as said aimed value 
information, h(H m (k) ) obtained by processing, with a one-way function h, H m (k) 
generated by said each participant device which, upon each processing of said 

20 initial value with a one-way function h, added the processed value with select 
information b m (k) indicating whether said value was an aimed value for each 
value of said index k and repeated this processing from at least the index 1^ 
corresponding to said aimed value to the upper limit value K of said index k; 
said initial value updating means includes a one-way function h 

25 processor by which {H m (k " 1} , b m } received from said each participant device in 
answer to an inquiry for said index k is processed with a one-y function h to 
generate H m (k) = KHj^H b m (k) ); and 



103 

said server device includes an updated initial value comparator for 
making a check to see if said H m (k) matches Hj 10 in {H m (k) , b m (k+1) } 
previously received. 

94. The system of claim 86, wherein said aimed value transformer of 
5 said each participant device comprises: 

a conversion table memory which has stored therein a conversion table 
which defines indexes k = 1, 2, K corresponding to K kinds of values 
selectable as aimed values, for converting said aimed value PR^ to the 
corresponding index k^; 
10 a one-way function g processor which processes said initial value IV m 

with a one-way function g by a predetermined number of times ^ to generate 
g^IVJ; 

a one-way function h processor which processes said g^IV^ with a 
one-way function h K-k^ times to generate H m (K) = h^Cg^IVJ) as said 
1 5 aimed value information; and 

response generating means which responds to a request from said 
server device for k to decide whether k=k m , and if true, generates H^" 1 * = h b 
^(g^IVJ), and if false, generates H m (tl) = g^IVJ; and 

wherein said sending means sends said H m (k " 1} in response to said 
20 request from said server device for said k; and 
in said server device: 

there is published on said bulletin board H m (K) = h K " km (g xm (IV rn )) as said 
aimed value information received from said each participant device, which 
further comprises a one-way function h processor by which Hj k ' 1} received 
25 from said each participant device as an answer to an inquiry for said k is 
processed with a one-way function h to generate h(H rn (k " 1) ), and a one-way 
function g processor for processing said answer Hj 1 ^ with a one-way 
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function g to generate gfTH^" 1 ^; and 

said control means: makes a check to see if said h(H m (k " l) ) matches said 
aimed value information H m (K) published on said bulletin board; if a match is 
detected, updates said aimed value information Hj K) with said Hj*" 1 * and 
5 decrements said index k on said counter by one; and if a mismatch is detected, 
makes a check to see if said g(H m (k>I) ) matches said aimed value information 
H m (K) ; and if a match is detected, determines, based on k and m at that time, 
the maximum or minimum aimed value PR^ and the participant device m 
having offered said value PR m . 
10 95. The system of claim 86, 87, 88, 91, 92, 93 or 94, wherein said 

aimed value transformer of said each participant device comprises; 

a conversion table memory which has stored therein a conversion table 
which defines the relationships between a sequence of values selectable as 
said aimed values and a sequence of indexes k of integral values respectively 
1 5 corresponding thereto, for converting said aimed value PR^ to the 
corresponding index k m ; 

a fraction calculating part which, letting an arbitrary aimed value PR 
be represented by PR = F(k)+Q, where F(k) is a value in said conversion table 
corresponding to said k and Q is a fraction which is a positive integer which 
20 satisfies F(k+l)-F(k)>Q>0, calculates said fraction Q m = PR m -F(k m ) based on 
F(k m ) obtained from said conversion table and said aimed value PRm; and 

a one-way function h processor which processes said initial value IV m 
with said one-way function h by the number of times corresponding to said 
to generate said aimed value information; and 
25 wherein said sending means sends said fraction Q m to said server 

device together with said aimed value information; and 
in said server device: 
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there is published on said bulletin board said fraction Q m received 
from said each participant device together with said aimed value information; 
and said server device comprises: 

a sequencer for deciding the sequence of said fractions Q m on said 
5 bulletin board; and 

select information comparator for checking whether said select 
information b m (k) is equal to a value b indicating the selection of the aimed 
value corresponding to said index k in said decided sequence of fractions Q m . 

96. The system of claims 86, 87, 88, 91, 92, 93 or 94, wherein said 
10 sequence of index values k and said sequence of values selectable as said 

aimed values on said conversion table are monotone increasing values in the 
same direction, and said server device determines the maximum aimed value. 

97. The system of claims 86, 87, 88, 91, 92, 93 or 94, wherein said 
sequence of index values k and said sequence of values selectable as said 

15 aimed values on said conversion table are monotone increasing values in 
opposite directions, and said server device determines the minimum aimed 
value. 
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ABSTRACT OF THE DISCLOSURE 

A bid-opening device 20 receives from each bidding device 10 m a 
bidding price index y m = g(h k (IVJ) (where IV m is an initial value, h k indicates 
k-times processing with a one-way function h and g is a one-way function) 
5 and its identifier ID m . The received information is stored on a common 
bulletin board 25. D m = h k (IVJ (where D m = g(DJ is generated with k set 
as the upper limit value K of the bidding price. The bulletin board 25 is 
checked for y m which matches this D m . If no match is found, m is 
incremented by one, and the check for y m -D m matching is made for each of m 
10 bidding devices. Upon completion of the matching for all the bidding 
devices, k is decremented by one, and a check is made for for y m which 
matches D m = g(h k (IV m )), and the index k for which they match is determined 
as the highest price bid. The bid-opening device 20 outputs that k and the 
identifier ED m of y m . 
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(U.S. Application Serial No.) 
(U.S. Application Serial No.) 



(U.S. Filing Date) 
(U.S. Filing Date) 



(Sta, 



i— patented, pending, abandoned) 



(Status-patented, pending, abandoned) 



I hereby appoint Elliott I. Pollock, Registration No. 16,906; George Vande Sande, Registration No. 17,276; Burton A. Amernick, Registration No. 24,852; 
Stanley B. Green, Registration No. 24,351; Richard Wiener, Registration No. 18,741; Townsend M. Belser, Jr., Registration No. 22,956; Morris Liss, 
Registration No. 24,5 10; Martin Abramson, Registration No. 25,787; George R. Pettit, Registration No. 27,369; Elzbieta Chlopecka, Registration No 32,767; 
Eric J. Franklin, Registration No. 37,134; and Jeffri A. Kaminski, Reg. No. 42,709, my attorneys with full power of substitution and revocation, to prosecute 
this application and to transact all business in die Patent and Trademark Office connected therewith. 



Send Correspondence and Direct Telephone Calls to: 
(202) 331-7111 



I hereby declare that all statements made herein of my own knowledge are true ; 
rue; and further that these statements are made with the knowledge that willful false 
■r both, under 18 U.S.C. § 1001 and that such willful false statements may jeopardi 



Pollock, Vande Sande & Amernick, r.l.l.p. 
P.O. Box 19088 
Washington, D.C. 20036-3425 U.S.A. 

t all statements made on information and belief are believed to be 
s and die like so made are punishable by fine or imprisonment, 
; the validity of the application or any patent issued thereon 



Full name of sole or first inventor- 
Inventor's Signature 
Residence Address 



KUNIO KOBAYASHI 



July 7, 2000 



B-203, 4-22-l£ Katriariyahigashi,Kanazawa-ku, Yokohama- shi, Kanagawa 236-0042 



Japan 



Post Oftict 
M See nm 



C/Q NIPPON TELEGRAPH AND TELEPHONE CORPORATION, 20-2 Nishi-Shinjuku 3-chcm e, 



' page for additional it 



Shinjuku-ku, Tokyo 163-1419, Japan 
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e of second joint inventor Uf any): HIKARU MORITA 



Inventor's Signature (^^'JUX^a/^t^^ Date July 7, 2000 

Residence Address 1-64-3, Tomiokanishi , Kanazawa-ku, Yokohama-shi, Kanagawa 236-0052 Japan 

Citizenship Japan 

Post Office Address C/0 NIPP0N TELEGRAPH AND TELEPHONE CORPORATION, 20-2 Nishi-Shinjuku 3-chome 

Shinjuku-ku, Tokyo 163-1419, Japan 



e of third joint 



KOUTAROU SUZUKI 



nventor's Signature f&UXMFtO 'Sn^f^^, Date July 7 ; 2000 

Residence Address 2-1-3-2-303, Hayashi, Yokosuka-shi, Kanagawa 238-0315 Japan 

citizenship Japan ^^^^^^^ 

Post Office Address C/O NIPPON TELEGRAPH AND TELEPHONE CORPORATION, 20-2 Nishi-Shinjuku 3-cho me, 

Shinjuku-ku, Tokyo 163-1419, Japan 



Full name of fourth joint ir 

Inventor's Signature 

Residence Address 

Citizenship 

Post Office Address 



Full name of fifth joint inventor (if any): _ 

Inventor's Signature 

Residence Address 

Citizenship 

Post Office Address 



Full name of sixth joint 

Inventor's Signature 

Residence Address 

Citizenship 

Post Office Address _ 



Residence Address 

Citizenship 

Post Office Address 

Full name of eighth joint ir 

Inventor's Signature 

Residence Address 

Citizenship 

Post Office Address 



